The European Union’s Cyber Resilience Act: Good Intentions, Impossible Requirements

As the European Union (EU) prepares to finalize its Cyber Resilience Act (EU CRA), product manufacturers with any digital components must brace themselves for compliance within three years of the act’s final publication. If enacted, the EU CRA will impose stringent cybersecurity obligations on manufacturers, aiming to enhance product security throughout their lifecycle. This ambitious legislation seeks to reduce vulnerabilities in products sold in the EU market, improve transparency through Software Bills of Materials (SBOMs), and protect both businesses and consumers utilizing these products. However, as the act takes shape, it faces significant criticism for being overly ambitious and potentially unachievable.

The Vision Behind the EU CRA

The EU CRA is designed to hold manufacturers accountable for cybersecurity, ensuring that products are secure from the outset and remain so throughout their operational life. By mandating SBOMs and attestations, the act aims to foster transparency in software supply chains, allowing consumers and businesses to understand the security posture of the products they use. This initiative reflects a growing recognition of the importance of cybersecurity in an increasingly digital world.

However, despite its noble intentions, the act has drawn skepticism from experts in the field. Tony Rutkowski, a seasoned consultant in legal, regulatory, and compliance matters, describes the EU CRA as one of the most flawed cybersecurity acts he has encountered in his extensive career. He acknowledges the EU’s track record of enacting effective legislation, such as the General Data Protection Regulation (GDPR), but warns that the CRA may be an overzealous attempt to address cybersecurity concerns.

The Flaws in the Current Draft

Rutkowski’s concerns center around the act’s potential to create more problems than it solves. He argues that the stringent requirements could deter manufacturers from entering the EU market, ultimately leading to a decrease in cybersecurity rather than an improvement. The fear is that if compliance costs become too burdensome, companies may choose to withdraw from the EU altogether, leaving consumers with fewer options and potentially less secure products.

The EU CRA currently applies to 26 product sectors, but it excludes products governed by other EU legislation, such as those in the medical, automotive, and military sectors. This broad scope, combined with a lack of rationalization in the list of affected products, creates confusion and uncertainty for manufacturers. Rutkowski notes that while lobbyists have attempted to influence the list, no coherent framework has emerged.

Competing Regulations and Overlapping Requirements

The EU CRA’s requirements may conflict with existing legislation and standards tailored to specific industries, such as finance, water, and nuclear power. Rutkowski highlights the potential for a "race to the top," where overlapping regulations could create a convoluted compliance landscape for manufacturers. If the CRA is enacted before more targeted regulations are finalized, companies may find themselves navigating a complex web of requirements that could stifle innovation and hinder their ability to operate effectively in the EU.

Moreover, the act’s provisions regarding lifetime liability for vendors and responsibility for end-user security raise significant concerns. Rutkowski argues that these expectations are unrealistic, given the diverse ways software is implemented and used across organizations. The porous nature of software distribution further complicates jurisdictional issues, as many vendors are not based in the EU, yet their products can be accessed globally.

The Challenge of SBOMs

One of the key components of the EU CRA is the requirement for SBOMs, which aim to provide transparency regarding the components and dependencies of software products. While the concept of SBOMs is beneficial, Rutkowski warns that the CRA’s specific requirements may differ from those established by other organizations, such as the Cybersecurity and Infrastructure Security Agency (CISA) in the United States. This divergence could lead to confusion among manufacturers, complicating compliance efforts.

Rutkowski emphasizes that the CRA’s approach to SBOMs must be carefully aligned with ongoing efforts in other jurisdictions to avoid creating additional burdens for manufacturers. The potential for conflicting requirements could deter companies from engaging with the EU market, as they may be reluctant to expose their proprietary information and software code.

The Risk of Vendor Revolt

As the EU CRA moves closer to implementation, Rutkowski raises the issue of "proportionality." If the costs and challenges associated with compliance outweigh the benefits, manufacturers may choose to abandon the EU market or lobby for the act to be struck down. This scenario is not unprecedented; similar situations have occurred in the past when vendors felt overwhelmed by regulatory demands.

To navigate this complex landscape, Rutkowski advises manufacturers to stay informed about developments related to SBOMs and engage with relevant working groups. By participating in discussions and collaborating with industry peers, companies can better prepare for the challenges posed by the EU CRA and other overlapping regulations.

Conclusion: A Call for Balanced Regulation

The EU CRA represents a significant step toward enhancing cybersecurity in the digital age, but its current draft raises serious questions about feasibility and proportionality. While the intent behind the act is commendable, its execution must be carefully considered to avoid unintended consequences that could hinder innovation and reduce overall cybersecurity.

As the EU continues to refine the CRA, it is crucial for stakeholders to engage in constructive dialogue, ensuring that the final legislation strikes a balance between robust cybersecurity measures and the practical realities faced by manufacturers. Only through collaboration and a thoughtful approach can the EU hope to achieve its goal of a more secure digital landscape without stifling the very innovation it seeks to protect.