EU Cyber Resilience Act (CRA)

The CRA regulations apply to connected hardware and embedded systems, software and digital control systems, and cloud-connected and network-enabled products.

Non-connected products are not covered by the CRA. In addition, products governed by sector-specific EU regulations are not covered by the CRA.

Eaton’s secure-by-design product development process and existing vulnerability response and disclosure practices are being enhanced by additional governance and cross-functional alignment across engineering, cybersecurity, quality and legal teams. In addition, Eaton is conducting a product portfolio assessment to identify in-scope products and mapping requirements to the product lifecycle.

Eaton participates in CEN/CENELEC to support development of European and international standards that incorporate quality, safety, environmental, interoperability and accessibility requirements.

• Cybersecurity is a fundamental part of Eaton’s “secure by design” approach and is built into every product we deliver. Eaton already manages cybersecurity risks throughout the entire product lifecycle, from early design and risk analysis to testing, deployment and ongoing support, as the CRA now requires.
• The CRA brings new reporting obligations regarding actively exploited vulnerabilities and severe incidents.
• There are legacy product exemptions within the CRA for products placed on the EU market before 11 December 2027. If an existing product undergoes a substantial modification after December 2027, it loses the legacy exemption and must fully comply with CRA.

Supplier selection and contracting

• The CRA requires manufacturers to take reasonable steps to ensure that products we procure, import or distribute meet the CRA’s essential cybersecurity requirements. The CRA requires that cybersecurity be embedded in Eaton’s supplier selection and contracting processes. 

SBOMs and technical documentation

• The CRA requires that manufacturers require suppliers to provide a SBOM and technical documentation for their products as a condition of contract.

Contractual controls

• Contracts with suppliers must require that they meet Annex I standards, provide SBOMs and documentation, and maintain vulnerability disclosure processes, with indemnities if they fail to do so.

Distribution obligations

• For distribution of third-party products, Eaton must verify CE marking, EU declaration of conformity and manufacturer/importer documentation before contracts are signed.
• For white-label products sold under the Eaton name, Eaton has full manufacturer obligations.
• For products we customize or modify, such as adding firmware, software or integrating a product, this may constitute a substantial modification and trigger full manufacturer obligations.
• If non-compliance is discovered after procurement, Eaton should halt distribution and notify the manufacturer and importer.