The Cyber Resilience Act and its Implications on the Automotive Industry

### Overview In this presentation, Stefan Ross, a Senior Manager at Deloitte specializing in secure product engineering and regulatory frameworks, examines the European Union's Cyber Resilience Act (CRA) and its direct and indirect ramifications for the automotive industry. Hosted by Santosh Mador, the session details how shifting business models—such as OEMs evolving into broader mobility service providers and supplying components outside standard vehicle architectures—place automotive companies within the CRA's scope. The speaker analyzes interactions between the CRA, UNECE UN R155, and ISO/SAE 21434, offering guidance on building unified product security architectures rather than isolated compliance silos.

### Key Topics - **Automotive Regulatory Landscape**: Traditional type approvals under UN R155 and ISO/SAE 21434 govern vehicle categories M, N, and L. However, emerging regional standards (such as China's GB 44495 and India's AIS 189) alongside sector standards like ISO 24882 for agricultural vehicles introduce compounding regulatory complexity. - **Scope and Exclusions of the CRA**: Entered into force in November 2024 as an EU regulation directly applicable across member states, the CRA covers connected hardware and software products with digital elements. While vehicles covered under EU Regulation 2019/2144 are exempted under the *lex specialis* principle, out-of-scope categories (e.g., special-purpose vehicles, agricultural vehicles, off-the-shelf components, external digital services, and B2B components) fall squarely under the CRA. - **Core Requirements & Penalties**: The CRA mandates security by design, at least five years of product security support/updates, Software Bills of Materials (SBOMs), vulnerability management, and absence of known exploitable vulnerabilities. Non-compliance risks fines up to €15 million or 2.5% of global annual turnover, alongside the potential loss of CE marking required for EU market access. - **Mapping to ISO/SAE 21434**: While many CRA security principles map conceptually to ISO/SAE 21434, the CRA differs significantly by imposing concrete timelines, legal obligations across economic operators (manufacturers, distributors, importers), customer communication baselines, market surveillance conformity assessments, and direct reporting obligations. - **Strategic Architecture (MVC Pattern)**: Rather than maintaining fragmented compliance teams for each standard (UN R155, GB, CRA), organizations should adopt a decoupled framework akin to Model-View-Controller (MVC): a strong core Product Security Target Operating Model (Model), tailored via controllers to meet specific regional or product regulatory views.

### Technical Details & Implementation Deadlines - **Deadlines**: The final deadline for all CRA obligations is December 2027, but incident and vulnerability reporting requirements take effect earlier (September 2027). During the Q&A, it was highlighted that early notification to CSIRTs/ENISA within 24 hours of becoming aware of an actively exploited incident is mandated. - **Harmonized Standards**: Harmonized horizontal standards (covering risk assessment, vulnerability handling, and supplier management) and vertical product standards are being drafted but may only be released shortly before enforcement. - **Conformity Assessments**: Approximately 90% of products falling under the default category will require self-assessment for CE marking compliance, whereas critical categories will face third-party conformity assessments. - **B2B and Economic Roles**: The CRA applies across B2B and B2C settings. Suppliers delivering connected sub-products or placing components on the EU market operate as manufacturers under EU product law guidelines (such as the Blue Guide).

### Takeaways Automotive manufacturers and suppliers cannot rely solely on vehicle type-approval exemptions. If an organization manufactures or imports connected software, hardware, or mobility services used outside vehicle-type approval scopes, CRA compliance is mandatory. Organizations should leverage existing ISO/SAE 21434 maturity as a foundational baseline, extend shift-left security directly into business and architectural decisions, and build unified, reusable security capabilities to address emerging global regulations without creating redundant compliance overhead.