normakte / CRA for firmware
For the CRA, firmware is not a separate topic but part of the device. The device manufacturer is responsible – including for libraries and modules it buys in.
| Topic | What the CRA expects |
|---|---|
| Third-party components | due diligence in selection, SBOM, remedying vulnerabilities |
| Updates | secured delivery channel, verification before installation, free of charge |
| Default settings | secure configuration out of the box, no universal default passwords |
| Lifetime | support period reflecting the expected period of use |
Operating system, bootloader, protocol stacks and third-party libraries are part of the product. The manufacturer exercises due diligence on them, records them in the SBOM and remedies vulnerabilities even when they come from a purchased component.
Updates are delivered through a secured channel and verified before installation, for example through signed firmware. Where appropriate, security updates run automatically, with an easy way to switch this off.
Embedded devices often stay in the field for many years. The support period must reflect this expected period of use, and the update path must work throughout.
Register, classification, SBOM, reports with deadlines and a target page for users – one trial file free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.