DuoKey
Compliance

EU Cyber Resilience Act (CRA)

Security requirements for every product with digital elements sold in the EU, from device identity and signed updates to vulnerability handling over the support period.

Talk to usExplore solutions

Requirements

What the regulation expects

The Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force on 10 December 2024. Manufacturers must report actively exploited vulnerabilities and severe incidents from 11 September 2026, and the essential requirements of Annex I apply from 11 December 2027. Products must be designed with a secure default configuration, protect against unauthorised access with appropriate authentication and identity management, protect the confidentiality and integrity of data, commands and software, and receive security updates over a support period that is normally at least five years. Non-compliance with the essential requirements can be fined up to EUR 15 million or 2.5 % of worldwide annual turnover, whichever is higher.
What the regulation expects

Secure by design, for every product

The CRA applies to hardware and software products with digital elements placed on the EU market, with CE marking tied to cybersecurity.

Authenticated devices and updates

Integrity and authenticity of firmware and updates need signing keys that cannot be copied off a build server.

Long support periods

Devices sold in 2027 may still need patches, renewed certificates and new algorithms in the 2030s.

Solutions

How DuoKey supports the framework

Factory device certificate provisioning

A unique X.509 certificate per device over EST or CMP on the production line, with OCSP and CRL revocation.

Learn more

Code signing with non-exportable keys

Firmware, software and container signatures made in a vault or HSM, under approval and with a complete journal.

Learn more

Cryptographic inventory

Discovery and a cryptographic bill of materials (CBOM) next to the SBOM the CRA asks for.

Learn more

Key themes

Where independent key control fits

DuoKey supports manufacturers with building blocks for Annex I. The CRA does not certify key managers or PKIs: conformity is assessed on your product, and the mapping below shows where DuoKey contributes evidence.

Protection from unauthorised access (Annex I, Part I)

Unique device identities and mutual authentication instead of shared credentials, with per-device revocation through OCSP and CRL.

Relevant products
PKI and certificate management

Confidentiality of stored and transmitted data (Annex I, Part I)

State-of-the-art encryption with keys held in an HSM, a cloud KMS or an MPC vault, outside the systems that store the data.

Relevant products
OpenBAO + DuoKey SD-HSM

Integrity of data, commands and software (Annex I, Part I)

Signed firmware, software and container images, with signing keys that never leave the vault and an approval policy on each signature.

Relevant products
Code signing service

Security updates over the support period (Annex I, Part II)

Authenticated over-the-air updates and renewable device certificates, so devices can still be patched and re-keyed years after shipment.

Relevant products
Secure OTA updates

Vulnerability handling and SBOM (Annex I, Part II)

A cryptographic inventory of algorithms, keys and certificates per product, to find what a new cryptographic weakness affects.

Relevant products
Cryptographic posture management

Resources

Continue reading

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform