Updated: 30 March, 2026
27 March, 2026
As we navigate 2026, the EU’s digital landscape has fundamentally shifted. While the Cyber Resilience Act (CRA) and the Cybersecurity Act (CSA) both aim to secure the digital market, the difference is simple: the CRA is a mandatory legal requirement for market entry, while the CSA is a voluntary framework for excellence.
To build a successful strategy, you must distinguish between these two roles:
- Cyber Resilience Act (CRA): A product safety law. It requires hardware and software to meet essential security standards and bear a CE mark before they can be sold in the EU.
- Cybersecurity Act (CSA): A framework for trust. It provides a library of optional certification schemes that companies use to prove high-level quality to their customers.
Essentially, the CRA sets the “security floor” you must stand on to exist in the market, while the CSA provides the “badges of honor” that help your products stand out.
Key Takeaways
- While the Cyber Resilience Act (CRA) is a mandatory regulation required for market entry, the Cybersecurity Act (CSA) provides a voluntary framework for earning higher-level security certifications.
- A critical synergy exists where products certified under CSA schemes (at substantial or high levels) are legally presumed to comply with CRA requirements, allowing manufacturers to skip redundant third-party testing.
- The CRA focuses specifically on connectable hardware and software (Products with Digital Elements), whereas the CSA covers a broader scope including ICT services and organizational processes.
- Both acts empower ENISA, using it as a permanent center of expertise for certification under the CSA and as an operational hub for vulnerability reporting under the CRA.
- The CRA sets a mandatory “security floor” for all digital products through CE marking, while the CSA provides the “badges of honor” that help companies demonstrate elite security to gain a competitive edge.
Comparing the Cyber Resilience Act (CRA) and the Cybersecurity Act (CSA)
The EU utilizes two primary laws to secure its digital market: the Cybersecurity Act (CSA) and the Cyber Resilience Act (CRA). Although they both aim to increase digital safety, they operate in fundamentally different ways.
The Cybersecurity Act (CSA): A Framework for Trust
Adopted in 2019, the CSA focuses on building high-level governance and a common language for security excellence across Europe.
Key features of the CSA include:
- ENISA’s Mandate: It established a permanent role for the EU Agency for Cybersecurity as the region’s center of expertise.
- Certification Framework: It created a system for Union-wide certificates for ICT products, services, and processes.
- Voluntary Nature: Compliance is generally a business choice used to prove security.
The Cyber Resilience Act (CRA): Mandatory Product Safety
In contrast, the CRA was introduced in 2024 to address widespread vulnerabilities in connected devices. It moves the EU from optional security to mandatory requirements for nearly all digital products.
Key features of the CRA include:
- Market Entry Requirements: Manufacturers must meet essential security standards to place “products with digital elements” on the EU market.
- Lifecycle Obligations: It mandates vulnerability handling and the provision of security updates for a set support period, typically at least five years.
- CE Marking: Products must undergo conformity assessments to earn the CE mark, which acts as a “passport” for the digital single market.
In short, while the CSA provides a voluntary framework for proving high-level security, the CRA establishes the mandatory legal “floor” that products must meet to exist in the EU market.
Why the EU Created Both the CRA and CSA: Key Policy Objectives
While both regulations protect the digital market, they prioritize different outcomes. The Cyber Resilience Act (CRA) is built around the concept of product safety, while the Cybersecurity Act (CSA) focuses on creating a system of trust.
CRA: Fixing the “Security Gap” in Products
The primary mission of the CRA is to address a specific market failure: the low level of cybersecurity in connected hardware and software. It shifts the burden of security from the end-user to the manufacturer.
Its core objectives include:
- Lifecycle Security: Ensuring products are not just secure at the point of sale but are actively maintained with security updates for years.
- Transparency: Providing clear information, such as support end-dates, so buyers can choose products based on their long-term security.
- Market Gatekeeping: Acting as a legal barrier that prevents non-compliant, vulnerable devices from being sold within the EU.
CSA: Harmonizing the Language of Excellence
The CSA’s mission is more about governance and providing a toolkit for high-level security verification. It aims to eliminate the confusing “patchwork” of different national security labels.
Its core objectives include:
- Certified Quality: Creating a reliable way for companies to prove their products or services meet elite security standards through EU-wide recognized certificates.
- Centralized Expertise: Empowering ENISA to act as the EU’s definitive voice on cyber threats and standard-setting.
- Mutual Recognition: Establishing common evaluation criteria so that a certificate issued in one Member State is automatically trusted in all others.
In simple terms, the CRA is about making sure products are safe to use, while the CSA is about making sure those products are officially trusted.
Mandatory Market Access (CRA) vs. Voluntary Certification (CSA)
The most critical difference for businesses to grasp is that while one regulation is a suggestion for market excellence, the other is a legal requirement for market entry. Failing to understand this distinction can result in products being blocked from the EU market.
The Cyber Resilience Act: A Mandatory “Passport”
The Cyber Resilience Act (CRA) functions as a mandatory gatekeeper. You cannot legally sell hardware or software in the EU unless it meets the CRA’s requirements.
Key mandatory features include:
- CE Marking: All products must undergo conformity assessments and bear the CE mark to prove they meet essential security standards.
- Strict Enforcement: National market surveillance authorities have the power to recall non-compliant products or issue heavy fines.
- Forced Compliance: Unlike previous “best practice” guidelines, the CRA applies to all “products with digital elements” throughout their entire lifecycle.
The Cybersecurity Act: A Voluntary “Badge of Honor”
In contrast, the Cybersecurity Act (CSA) provides a library of voluntary certification schemes. It does not force you to certify your product, but it gives you a recognized way to prove its quality.
Key voluntary features include:
- Trust Framework: Companies choose to certify their ICT products or services to earn a “badge of trust” recognized across all 27 Member States.
- Quality Levels: It offers three assurance levels, basic, substantial, and high, allowing businesses to show exactly how rigorous their security testing was.
- Competitive Edge: While not required for most products, these certificates are often used as powerful marketing tools to win customer trust.
Where the Two Meet: The Mandatory Crossover
The line between voluntary and mandatory blurs for “critical” products. Under the CRA, certain high-risk categories, such as smartcards or hardware security modules, may be legally required to obtain a certificate from a CSA scheme like the EUCC.
In these cases, the voluntary “medal” becomes a mandatory “passport” for doing business in Europe.
The Compliance Shortcut: Using CSA Certificates for CRA Conformity
Obtaining a Cybersecurity Act (CSA) certificate is more than a “badge of honor”, it is a strategic shortcut for meeting mandatory Cyber Resilience Act (CRA) requirements. This synergy helps manufacturers streamline their path to market and avoid redundant, costly testing.
The “Presumption of Conformity”
The most significant link between the two laws is the legal concept of “presumption of conformity”. Under Article 27 of the CRA, if your product is certified under a CSA scheme identified by the European Commission, it is legally presumed to meet the corresponding mandatory security requirements.
- Ready-Made Evidence: Instead of building a compliance file from scratch, your existing CSA certificate acts as immediate proof for specific CRA rules.
- Simplified Access: This allows for smoother market entry across all EU Member States.
Skipping Redundant Audits
For “important” or “critical” products, the CRA usually mandates an assessment by an independent third party (a Notified Body). However, a CSA certificate can eliminate this extra step.
- Assurance Levels: If you hold a CSA certificate at an assurance level of “substantial” or “high,” you are generally exempt from separate third-party audits for those requirements under the CRA.
- Efficiency: Using one rigorous certification, like the EUCC (Common Criteria), to satisfy both regulations significantly reduces administrative burdens.
A Unified Strategy
By aligning your CSA certification plans with your CRA obligations, you turn voluntary trust into practical compliance. This unified approach allows companies to focus on innovation while ensuring their products meet the highest safety standards required for the EU market.
Quick Reference Guide: CRA vs. CSA Comparison Table
Understanding how these two regulations interact is essential for any company operating in the EU digital market. While they share the goal of a more secure Europe, their legal impact on your business differs significantly.
| Feature | Cyber Resilience Act (CRA) | Cybersecurity Act (CSA) |
| Legal Nature | Mandatory; a requirement for all products sold in the EU. | Voluntary; a framework for optional security “badges.” |
| Primary Focus | Product Safety; focuses on hardware and software properties. | Trust Framework; focuses on certification and ENISA’s role. |
| Scope | Products with Digital Elements (PDEs). | ICT Products, Services, and Processes. |
| Market Access | CE Marking is required to enter the digital single market. | Certificates provide a competitive edge only. |
| Reporting | Mandatory reporting of exploited vulnerabilities within 24 hours. | Cooperative framework for sharing best practices. |
Choosing Your Path to Compliance
Navigating these regulations does not have to be a double burden. By strategically pursuing a CSA certification at a “substantial” or “high” level, manufacturers can often satisfy the CRA’s mandatory requirements in one go.
- Step 1: Identify if your product is “important” or “critical” under the CRA.
- Step 2: Check if an existing CSA certification scheme covers your product category.
- Step 3: Use the “Presumption of Conformity” to streamline your CE marking process.
This unified approach ensures that your products are not only legally compliant but also recognized as leaders in security excellence across the European Union.
Conclusion
Understanding the interaction between the Cyber Resilience Act and the Cybersecurity Act is essential for any organization operating in the EU digital market. While they prioritize different outcomes, they are designed to be complementary tools in the Union’s security toolkit.
As we move through 2026, the timeline for compliance is becoming a practical reality rather than a distant goal. Key takeaways for your strategy include:
- Mandatory vs. Voluntary: The CRA is a legal requirement for market entry, setting the mandatory “security floor” for nearly all digital products. The CSA remains a voluntary framework for proving elite security quality.
- The 2026 Milestone: Organizations must prepare now for the CRA’s first major deadline in September 2026, when mandatory reporting for actively exploited vulnerabilities and severe incidents begins.
- The Compliance Shortcut: Obtaining a CSA certification, such as the EUCC, is a strategic move. It can allow manufacturers to leverage the “Presumption of Conformity” to satisfy mandatory CRA requirements without redundant testing.
- Market Leadership: By aligning your product development with these standards early, you can streamline your path to a CE marking while positioning your products as trusted leaders in a highly regulated market.
Navigating these two regulations does not have to be a double burden. By identifying your product’s criticality today and utilizing existing CSA schemes, you can efficiently secure your “passport” to the European digital single market.
Are you ready for CRA?
With the CRA Framework in SAMMY, you can assess CRA compliance for your different products. The questions and quality criteria give you a complete checklist of everything that is required by CRA. SAMMY also makes it easy to compare products groups, manage compliance roadmaps and collaborate with team members.
Find out more about the SAMMY tool for CRA assessments.
