Many of today’s electronic products connect to networks and other devices to communicate, exchange data, coordinate tasks, and receive software updates. These connections make everyday work-life tasks incredibly convenient. However, this convenience also comes with risks. Weaknesses in these products can give cyberattacks a way into trusted devices. Responding to an attack takes time and money. Even worse, reputational damage can last long after the incident. To help reduce these risks, the European Union (EU) established common cybersecurity requirements that set a baseline for product development. The 2024 framework The Cyber Resilience Act (CRA), adopted in October 2024, establishes the requirements framework. Companies supplying digital products to the EU market must consider the CRA, whether they sell directly or supply components for a customer’s finished product. The rules apply regardless of where a company is based or where development takes place. The regulation applies to semiconductors sold separately. Manufacturers must exercise due diligence when incorporating third-party components into their products. Semiconductor intellectual property (IP) suppliers may need to provide security evaluation results and explain the assumptions for secure use. The 2026 requirements The CRA addresses widespread product vulnerabilities, inconsistent security updates, and insufficient information for secure use. The CRA’s mandatory reporting phase took effect in September 2026. When manufacturers learn that a vulnerability in their product is being actively exploited, or that a severe incident has affected its security, an early warning must be submitted. A more detailed notification follows, with a final report explaining the findings and corrective measures. Manufacturers submit these notifications through the CRA’s Single Reporting Platform. The CRA also lists semiconductor products such as microprocessors, microcontrollers, ASICs, and FPGAs according to core functionality, including security-related functions. The applicable category and obligations depend on the product and how it is placed on the market. Chip and IP companies need to understand which CRA responsibilities apply to their products and what information they may need to provide to customers. That determination can be challenging because commitments vary with the product’s classification. Figure 1 illustrates how suppliers may provide security evidence to support CRA reporting. Fig. 1: Illustrative supply chain showing how component information and security evidence may move between suppliers and the product manufacturer in support of its EU CRA documentation. (Source: Arteris, Inc.) CRA readiness To help companies prepare, Arteris developed the EU CRA Hardware Readiness Guide . It provides a checklist to help companies assess which products may fall within the CRA’s scope, identify who is responsible for each product, and determine what information customers may request. It also helps identify where classification, responsibility, processes, or security documentation may need further work. The guide distinguishes design-stage security evidence from a completed conformity assessment. The results can support a manufacturer’s compliance work, but it does not cover all of the manufacturer’s CRA duties. For the security assessment, the checklist asks companies to identify assets such as keys, configuration, and debug state. Companies can also define protection boundaries and document where those assets can and cannot travel. A design that performs its specified functions does not, by itself, show that sensitive assets remain protected. Suppliers can use the readiness guide to organize information and security evidence that may support customers as they prepare their technical documentation. Annex VII of the CRA lists what manufacturers must provide in their technical documentation. It includes cybersecurity risk assessments, relevant design and development information,