CRA Readiness Starts Before 2027: How ODOT Is Preparing Now

When does the EU Cyber Resilience Act really start?

For many manufacturers, December 2027 is still seen as the key date. But CRA readiness cannot simply be postponed until then.

The Cyber Resilience Act entered into force on December 10, 2024. Its main obligations will apply from December 11, 2027, while the reporting obligations under the CRA will begin to apply from September 11, 2026.

For manufacturers of products with digital elements, this means one thing:

CRA preparation needs to start before 2027.

CRA Is More Than a Final Compliance Check

Cybersecurity cannot simply be added to a product after development is finished.

For Industrial Automation manufacturers, CRA readiness involves much more than completing one test or preparing one technical document. It requires cybersecurity considerations to become part of the product lifecycle—from requirements and development to verification, vulnerability handling, updates and documentation.

At ODOT, this is the approach we are taking today.

Our preparation work is progressively connecting:

· Product requirement review

· Network interface and attack surface analysis

· Cybersecurity risk assessment

· Software and version control

· Product verification and testing

· Product and firmware traceability

· Vulnerability handling

· Software updates

· Technical documentation

The objective is to turn regulatory requirements into practical and traceable engineering actions.

From Product Requirements to Cybersecurity Risk Assessment

Cybersecurity starts much earlier than final product testing.

During the product requirement stage, security considerations need to be identified and incorporated into the development process. External interfaces—including network ports, communication protocols and other accessible interfaces—also need to be understood as part of the product's potential attack surface.
Once these interfaces are understood, potential cybersecurity risks can be identified, assessed and addressed.

The important point is not only to make engineering decisions, but also to ensure that the reasoning and resulting actions remain documented and traceable throughout the product lifecycle.

Cybersecurity Continues After the Product Leaves the Factory

CRA readiness does not end when a product is released.

Industrial products continue to evolve through firmware changes, software updates and new versions. When a security issue or vulnerability is reported, manufacturers need processes to receive, assess, remediate, verify and document the issue.

That makes vulnerability management a continuous activity rather than a one-time development task.

Software updates also need to be controlled and verified. Product identity—including serial number, hardware version and firmware version—helps link changes, test results and subsequent actions to the correct product configuration.

Documentation Is Part of the Lifecycle

Risk assessments, version records, test reports, vulnerability records and update records together form a traceable body of evidence.

Technical documentation therefore should not be treated as the final administrative step after engineering work is finished. It is part of the product lifecycle itself.

At the same time, relevant harmonised standards are still developing. ODOT continues to follow the standardisation process and will review and align its preparation activities as relevant standards become available.

ODOT Is Preparing Now

CRA is not one test.

It is not one document.

And it is not the responsibility of only one department.

It is a lifecycle connecting requirements, risk assessment, development, verification, version control, vulnerability handling, updates and documentation.

That is why ODOT is already working to translate cybersecurity requirements into practical engineering and product lifecycle processes.

CRA Readiness Starts Before 2027.

ODOT Is Preparing Now.

Watch the video to see how ODOT is approaching CRA readiness across the industrial product lifecycle.