Cyber Resilience Act (CRA) Services

From CRA compliance to secure, resilient and trusted products (software and hardware)

Cyber governance & compliance
Cybersecurity
Cybersecurity services

The EU Cyber Resilience Act (CRA) requires secure products and lifecycle compliance by 2027. Thales supports your journey from security by design and vulnerability management to certification and market access.

Build CRA Compliance into your product lifecycle

From product scoping to certification, Thales turns CRA requirements into secure products and sustainable compliance.

Clarify CRA requirements

Identify impacted products, applicable obligations, responsibilities and the right conformity path for certification.
Secure products by design

Identify and remediate product risks through risk analysis, enhance the security-by-design approach throughout the product lifecycle and realistic penetration testing.
Industrialise compliance

SBOM factory, technical documentations and reusable compliance evidence across your product portfolio.
Sustain compliance

Continuously monitor vulnerabilities, manage reporting obligations and maintain product security after market launch.
Prepare for certification

Validate technical documentation, controls and evidence before formal conformity assessment.
Move from gaps to action

Thales experts work alongside engineering teams to implement controls, remediate vulnerabilities and turn compliance plans into secure products.

What is changing with CRA compliance?

The CRA changes how digital products are designed, released, monitored and maintained. Organisations must embed security by design, continuously handle vulnerabilities and security updates, report actively exploited vulnerabilities and severe incidents, and demonstrate conformity before applicable products enter the European market.

Beyond regulatory compliance, the CRA’s requirements on vulnerability management and security-by-design can serve as a strategic foundation for strengthening resilience against the emerging and evolving security risks associated with frontier AI systems.

Non-compliance with CRA can result in fines of up to €15 million or 2.5% of global annual turnover, while late remediation can delay releases, increase lifecycle costs and affect market access and reputation. CRA readiness should therefore be treated not only as a compliance requirement, but as an investment in product resilience, customer trust and sustainable competitive advantage.

An end-to-end CRA compliance journey

CRA compliance is not a one-off assessment or certification exercise. Thales provides a tailored, modular journey from product scoping and risk analysis to security testing, compliance evidence, vulnerability operations, remediation and certification. Organisations can start according to their most urgent priority while every activity contributes to one continuous evidence chain that is enriched and reused throughout the product lifecycle.

How Thales helps you with CRA Compliance

Product risk analysis maps assets and data flows, identifies threats and vulnerabilities, evaluates risk and defines treatment priorities. Penetration testing then simulates realistic attacks across applications, APIs, infrastructure and hardware to validate product resilience, support remediation and re-test corrective actions.

The Thales Compliance Factory industrialises CRA compliance through modular services covering SBOM governance and generation, Security-by-Design guidelines, technical documentation and compliance artefacts. Evidence is structured, maintained and reused across products to reduce duplicated effort and improve traceability and audit readiness.

Thales establishes continuous vulnerability management capabilities combining governance, processes, technical platforms, reporting and dashboards. Product Security, Vulnerability Intelligence, SBOM management and CRA reporting readiness help organisations monitor emerging vulnerabilities, respond efficiently and maintain compliance after market launch.

Thales cybersecurity experts work alongside engineering teams to implement security controls, secure configurations, code changes, SBOM tooling and remediation actions. We validate implementation and transfer knowledge to internal teams, closing the gap between compliance recommendations and operational execution.

Thales provides an independent pre-audit of processes, security controls, SBOMs and technical documentation to identify remaining gaps before formal assessment. We then support the conformity and certification process, from assessment preparation and evidence review through to the final certification decision and European market access.

CRA compliance is the obligation. Trusted products are the outcome.

Thales combines regulatory expertise with product security, engineering, remediation, vulnerability operations and certification support. Rather than treating assessments, testing, SBOMs and documentation as isolated activities, we connect them through one continuous evidence chain - reducing duplicated effort, compliance uncertainty and time to market.

Frequently asked questions about the Cyber Resilience Act (CRA)

The CRA introduces cybersecurity requirements across the product lifecycle, including cybersecurity risk assessment, Security-by-Design, vulnerability handling, security updates, technical documentation, reporting obligations and conformity assessment. Organisations must be able to demonstrate that these requirements are addressed and maintained throughout the product lifecycle.

SBOMs help organisations understand and manage the software components and dependencies within their products, supporting vulnerability management, traceability and compliance evidence. Thales helps industrialise SBOM governance and generation alongside technical documentation and reusable compliance artefacts through its Compliance Factory approach.

No. CRA compliance extends beyond initial conformity assessment and requires cybersecurity to be maintained after a product enters the market. Organisations need capabilities to monitor vulnerabilities, manage security updates, fulfil reporting obligations and maintain relevant compliance evidence throughout the product lifecycle.

Preparation should begin with product scoping, classification and a gap assessment, followed by risk analysis, security testing and remediation. Organisations should also ensure that SBOMs, technical documentation, security controls and compliance evidence are complete and consistent before formal conformity assessment.