EU Cyber Resilience Act extends to chip and IP suppliers

The EU Cyber Resilience Act, adopted in October 2024, requires semiconductor and IP suppliers selling into the EU to provide security evaluation results and secure-use assumptions. Mandatory vulnerability reporting began in September 2026, with full conformity assessment and CE marking due on December 11, 2027.

• CRA was adopted in October 2024 and covers all suppliers placing products on the EU market
• Since September 2026 vulnerabilities and incidents must be reported via the Single Reporting Platform
• Full conformity assessment and CE marking are required from December 11, 2027
• Scope includes microprocessors, microcontrollers, ASICs and FPGAs