Security Becomes a Sign-off Item

By Moshe Zalcberg

October 12, 2026

Europe’s CRA turns chip security into auditable sign-off, pushing silicon teams to prove resilience before 2027.

Europe’s Cyber Resilience Act (CRA) will soon require chipmakers to prove their silicon is secure. The tools to produce that proof already exist, but they were built for a different purpose.

Europe goes first, again

On Sept. 11, the first operational part of the EU’s Cyber Resilience Act went live. From that day, any company selling a product with digital elements in Europe must flag actively exploited vulnerabilities and severe security incidents within 24 hours, with a fuller report within 72 hours, through a new reporting platform run by the EU’s cybersecurity agency, ENISA. The duty covers products already on the market, including ones shipped years ago. The rest of the law, the part that defines how products must be designed and assessed, applies from December 2027.

Europe is not the only one moving. Japan has set the rules for a new scheme that rates the security of companies in its supply chains, and the U.S. is set to require connected consumer devices bought by federal agencies to carry its Cyber Trust Mark label from January 2027. These are softer instruments, though: a voluntary rating, a label, a procurement rule. The CRA is binding law, with CE marking, fines, and a reporting clock, and it applies to anyone who sells into Europe, wherever they are based. As usual, the EU leads in regulation, for good and for bad.

What struck me while looking through the details is how directly the law reaches into our industry. Most of the commentary on the CRA has been written by lawyers and software security people, and it treats chips as a footnote. However, I believe that the CRA will change how chips are designed and verified, in ways the design community has barely started to discuss.

Chips are named in the law

The CRA sorts products into tiers by risk. Most products sit in a default category and can assess themselves. The law then lists specific product types in higher tiers, and chips are among them: microcontrollers and processors with security functions, tamper-resistant versions of those, and secure elements and smartcard chips at the top (the law firm CMS has a clear summary). For the top tiers, self-declaration is no longer enough, and an outside evaluator has to assess the product before it can carry the CE mark.

There is some legal nuance about whether a chip is a regulated product in its own right or is caught as a component of one, and a lot will depend on how customers use it. For a vendor of secure microcontrollers selling into Europe, though, the direction is clear.

To read the full article, click here