The EU Cyber Resilience Act Reaches Chip And IP Suppliers

Many of today’s electronic products connect to networks and other devices to communicate, exchange data, coordinate tasks, and receive software updates. These connections make everyday work-life tasks incredibly convenient. However, this convenience also comes with risks. Weaknesses in these products can give cyberattacks a way into trusted devices. Responding to an attack takes time and money. Even worse, reputational damage can last long after the incident. To help reduce these risks, the European Union (EU) established common cybersecurity requirements that set a baseline for product development.

The 2024 framework

The Cyber Resilience Act (CRA), adopted in October 2024, establishes the requirements framework. Companies supplying digital products to the EU market must consider the CRA, whether they sell directly or supply components for a customer’s finished product. The rules apply regardless of where a company is based or where development takes place.

The regulation applies to semiconductors sold separately. Manufacturers must exercise due diligence when incorporating third-party components into their products. Semiconductor intellectual property (IP) suppliers may need to provide security evaluation results and explain the assumptions for secure use.

The 2026 requirements

The CRA addresses widespread product vulnerabilities, inconsistent security updates, and insufficient information for secure use. The CRA’s mandatory reporting phase took effect in September 2026. When manufacturers learn that a vulnerability in their product is being actively exploited, or that a severe incident has affected its security, an early warning must be submitted. A more detailed notification follows, with a final report explaining the findings and corrective measures. Manufacturers submit these notifications through the CRA’s Single Reporting Platform.

The CRA also lists semiconductor products such as microprocessors, microcontrollers, ASICs, and FPGAs according to core functionality, including security-related functions. The applicable category and obligations depend on the product and how it is placed on the market. Chip and IP companies need to understand which CRA responsibilities apply to their products and what information they may need to provide to customers. That determination can be challenging because commitments vary with the product’s classification. Figure 1 illustrates how suppliers may provide security evidence to support CRA reporting.

Fig. 1: Illustrative supply chain showing how component information and security evidence may move between suppliers and the product manufacturer in support of its EU CRA documentation. (Source: Arteris, Inc.)

CRA readiness

To help companies prepare, Arteris developed the EU CRA Hardware Readiness Guide. It provides a checklist to help companies assess which products may fall within the CRA’s scope, identify who is responsible for each product, and determine what information customers may request. It also helps identify where classification, responsibility, processes, or security documentation may need further work. The guide distinguishes design-stage security evidence from a completed conformity assessment. The results can support a manufacturer’s compliance work, but it does not cover all of the manufacturer’s CRA duties.

For the security assessment, the checklist asks companies to identify assets such as keys, configuration, and debug state. Companies can also define protection boundaries and document where those assets can and cannot travel. A design that performs its specified functions does not, by itself, show that sensitive assets remain protected.

Suppliers can use the readiness guide to organize information and security evidence that may support customers as they prepare their technical documentation. Annex VII of the CRA lists what manufacturers must provide in their technical documentation. It includes cybersecurity risk assessments, relevant design and development information, and supporting evidence, where applicable. Dated, repeatable evaluations can help document the design examined, describe what was covered, and note any limitations. The guide also recommends mapping evaluation findings to named hardware weakness classes. The CRA sets security outcomes but does not mandate a specific evaluation method.

The Arteris checklist helps companies organize their preparation. In addition, Cycuity, an Arteris brand, offers Radix for hardware security verification, helping developers generate traceable security evidence. It translates security requirements into rules that can be checked in existing simulation and emulation flows. Radix-S checks those rules during simulation, and Radix-M carries them into emulation, allowing system-level analysis.

The software tracks designated assets, such as cryptographic keys and configuration data, through a design to identify flows that violate defined rules. It can also help assess whether Root of Trust features work as intended. Findings help companies locate potential weaknesses, measure security coverage, and identify areas for further testing.

What changes in 2027

December 11, 2027, marks the next major deadline. The CRA’s broader cybersecurity, conformity assessment, and documentation requirements take effect. CE marking will also be required, which declares that the product conforms to applicable EU requirements.

Before the full requirements take effect, hardware and IP suppliers can work with customers to identify which product versions are intended for the EU market. Early identification gives both sides time to align program schedules and plan necessary work while designs are still in development.

Arteris can help companies make sense of the CRA’s requirements and consider how they apply to hardware and IP products. The EU CRA Hardware Readiness Guide offers a practical starting point, and Arteris teams can help companies work through questions as they prepare.

The post The EU Cyber Resilience Act Reaches Chip And IP Suppliers appeared first on Semiconductor Engineering.