1 Introduction

The EU Cyber Resilience Act (CRA) is a mandatory legal framework that establishes uniform cybersecurity requirements for all hardware and software products with digital elements sold in the European Union market. CRA enforcement begins December 11, 2027. Vulnerability reporting requirements took effect, on September 11, 2026. For product manufacturers building connected devices that incorporate third-party semiconductor components, CRA creates a compliance challenge that cannot be solved by looking at silicon or software in isolation: the regulation assigns requirements to each role in the supply chain that places a product with digital elements on the EU market under its own name.

Products sold in the EU must follow secure design principles, stay updated, and maintain a credible vulnerability handling process throughout their support period. The compliance challenge comes from the supply chain structure of most embedded products. An OEM building a connected IoT gateway, industrial controller, or a collaborative robot typically integrates a microprocessor from a silicon vendor, a board support package (software) from a Tier 1 manufacturer or System on Module (SoM) vendor, with its own application software. Each party has placed components on the market, and each carries CRA responsibilities.

A product manufacturer cannot skip the CRA requirements by selecting a component from a supplier who has met the CRA requirements. Compliance from the component supplier does not satisfy the product manufacturer's risk assessment, conformity declaration (a formal statement that the product meets all CRA requirements), or requirement to report to the product manufacturer's national CSIRT (a national cybersecurity incident response team) and ENISA (the EU's cybersecurity agency). The two sets of requirements run in parallel; one does not substitute for the other. Non-compliance carries fines up to 2.5% of a company's global annual revenue. Component suppliers and intermediate integrators are not exempt.

This paper explains TI's reading of the supply chain boundary, what TI addresses at the silicon and SDK level to meet the requirements as a component manufacturer, and what the integrating product manufacturer must address for the complete product. Compliance determinations require qualified legal and compliance counsel.