The semiconductor sector is facing a significant regulatory shift as the European Union's Cyber Resilience Act (CRA) comes into force, as security requirements are no longer limited to software but have extended to include hardware components and Intellectual Property (IP) that form the backbone of modern digital devices.
CRA Framework and Scope of Application
The law, adopted in October 2024, aims to establish minimum security requirements for digital products sold in the EU market. These rules apply to companies regardless of their geographical location, as long as their products reach European consumers. The scope directly includes semiconductors sold separately, in addition to Intellectual Property providers who may be required to provide security assessment results and explain the assumptions for the safe use of their components.
The target list includes a wide range of technical products, including:
- Microprocessors.
- Microcontrollers.
- Application-Specific Integrated Circuits (ASICs).
- Field Programmable Gate Arrays (FPGAs).
Deadlines and Regulatory Obligations
The implementation of the law proceeds through specific time phases that impose pressure on technical development schedules:
- September 2026: Commencement of the mandatory reporting phase, where manufacturers must provide an early warning upon discovering actively exploited vulnerabilities, followed by a detailed report on corrective actions via a unified reporting platform.
- December 11, 2027: The deadline for full compliance, where technical documentation requirements and conformity assessment will come into effect, and obtaining the CE mark will be a prerequisite for placing products on the market.
Why Does This News Matter?
This development represents a fundamental shift in cybersecurity responsibility across the supply chain. Instead of placing the entire burden on end-device manufacturers, the law requires component and IP providers to provide tangible security evidence. This means chip design companies must prove that sensitive assets, such as encryption keys and debug states, are protected within the design itself, and not just through external software.
Preparation and Hardware Security Verification
In response to these challenges, specialized companies such as Arteris have begun developing tools to help designers comply, such as a Hardware Readiness Guide and verification tools like Radix. These tools aim to transform security requirements into rules that can be tested during the simulation and emulation stages, allowing for the identification of design vulnerabilities before the product reaches the final manufacturing stage.