Does the Cyber Resilience Act apply to AI products?
Yes, if the AI is part of a product with digital elements sold in the EU. The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for such products across their life, including secure design, vulnerability handling and security updates. High-risk AI systems that meet the CRA's essential requirements are deemed to meet the EU AI Act's cybersecurity requirement for those aspects.
How it works
- Check whether your product has digital elements and is placed on the EU market.
- Build in secure-by-design controls and a vulnerability handling process.
- Plan security updates for the product's expected life.
- Keep sealed records of releases and fixes. The free sebbi Seal timestamps each release.