The EU's Cyber Resilience Act, adopted in October 2024, now reaches semiconductor and IP suppliers, not just finished-product makers. Mandatory vulnerability reporting began in September 2026, and broader cybersecurity, conformity assessment, and documentation duties — plus CE marking — take effect on December 11, 2027. Arteris has published a hardware readiness guide, and its Cycuity brand offers Radix verification tools to help chip and IP companies produce traceable security evidence for customers preparing EU technical documentation.
According to semiengineering.com, the European Union’s Cyber Resilience Act (CRA), adopted in October 2024, sets common cybersecurity requirements for digital products sold in the EU market — and its obligations now extend to semiconductor and intellectual property (IP) suppliers, not just finished-product manufacturers.
Scope reaches chips and IP
The CRA applies to any company supplying digital products to the EU market, whether it sells directly or supplies components for a customer’s finished product. The rules apply regardless of where a company is based or where development takes place, according to the report.
The regulation applies to semiconductors sold separately, and manufacturers must exercise due diligence when incorporating third-party components into their products. Semiconductor IP suppliers may need to provide security evaluation results and explain the assumptions for secure use.
The CRA lists semiconductor products such as microprocessors, microcontrollers, ASICs, and FPGAs according to core functionality, including security-related functions. The applicable category and obligations depend on the product and how it is placed on the market.
Reporting obligations began in September 2026
The CRA addresses widespread product vulnerabilities, inconsistent security updates, and insufficient information for secure use. Its mandatory reporting phase took effect in September 2026.
When manufacturers learn that a vulnerability in their product is being actively exploited, or that a severe incident has affected its security, an early warning must be submitted. A more detailed notification follows, with a final report explaining the findings and corrective measures. Manufacturers submit these notifications through the CRA’s Single Reporting Platform.
Chip and IP companies need to understand which CRA responsibilities apply to their products and what information they may need to provide to customers. That determination can be challenging because commitments vary with the product’s classification.
Readiness guide and verification tools
To help companies prepare, Arteris developed the EU CRA Hardware Readiness Guide, a checklist to help companies assess which products may fall within the CRA’s scope, identify who is responsible for each product, and determine what information customers may request.
The guide distinguishes design-stage security evidence from a completed conformity assessment. The results can support a manufacturer’s compliance work, but do not cover all of the manufacturer’s CRA duties. Annex VII of the CRA lists what manufacturers must provide in their technical documentation, including cybersecurity risk assessments, relevant design and development information, and supporting evidence where applicable.
For the security assessment, the checklist asks companies to identify assets such as keys, configuration, and debug state, and to define protection boundaries and document where those assets can and cannot travel. The guide also recommends mapping evaluation findings to named hardware weakness classes; the CRA sets security outcomes but does not mandate a specific evaluation method.
In addition, Cycuity, an Arteris brand, offers Radix for hardware security verification, helping developers generate traceable security evidence. Radix-S checks rules during simulation and Radix-M carries them into emulation, allowing system-level analysis. The software tracks designated assets, such as cryptographic keys and configuration data, through a design to identify flows that violate defined rules, and can help assess whether Root of Trust features work as intended.
Full requirements land December 11, 2027
December 11, 2027, marks the next major deadline, when the CRA’s broader cybersecurity, conformity assessment, and documentation requirements take effect. CE marking will also be required, declaring that the product conforms to applicable EU requirements.
Before the full requirements take effect, hardware and IP suppliers can work with customers to identify which product versions are intended for the EU market. Early identification gives both sides time to align program schedules and plan necessary work while designs are still in development, according to the report.
Leon Brown, director of marketing for Cybersecurity at Arteris, focuses on hardware security assurance. According to his biography in the source, Brown has spent more than a decade in cybersecurity, spanning identity, public key infrastructure, quantum security, and post-quantum cryptography.
Source: SemiEngineering
Compiled from international media by the SCI.AI editorial team.
