Topic starter
24/10/2026 8:49 pm
TL;DR: Automotive suppliers still face product-level EU Cyber Resilience Act scope, Finite State says, even when finished vehicles are type-approved. Product inventories and market-path traceability now drive whether documentation, vulnerability handling, and support commitments stay consistent.
Editorial analysis by NHI Mgmt Group, based on content published by Finite State: “Cyber Resilience Act for Automotive Suppliers: The Car Is Exempt, but What's Inside Isn't”.
Key questions
Q: When should suppliers prioritise CRA mapping over product development work?
A: Before launch, especially for products that can be sold both inside and outside a vehicle.
Q: What signs show that a connected-vehicle product is becoming a compliance risk?
A: The warning signs are incomplete product inventories, reused components with no market-path traceability, outdated security documentation, and support or reporting commitments that differ across channels.
Q: What breaks when automotive suppliers assume vehicle approval covers every connected product?
A: They miss the product-level scope test.
Practitioner guidance
- Map every digital product by market path Create a product inventory that records whether each item is factory-integrated, sold separately, or reused across industries, because CRA applicability depends on placement on the market.
- Separate dual-use components into compliance tracks For modules used both in vehicles and as standalone products, document which obligations attach in each distribution model and preserve the evidence set for both.
- Reuse existing cybersecurity evidence where it is still current Gather design, testing, vulnerability, and secure handling documentation that already exists, then identify where it supports CRA expectations and where it is incomplete or outdated.
Bottom line: The article shows that CRA applicability in automotive depends on product placement, not on whether the company operates in a regulated vehicle programme.
Glossary terms: EU Cyber Resilience Act, Device Approval, Dual-use Technology, CRA Vulnerability Reporting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
CRA readiness in automotive is fundamentally an inventory problem. The decisive question is not whether a supplier is in the automotive sector, but whether each product is sold as part of type-approved vehicle compliance or as a separate digital product. That distinction changes the regulatory duty, the documentation burden, and the remediation timeline. Practitioner conclusion: product catalog governance now sits on the compliance critical path.
A question worth separating out:
Q: How should security and compliance teams divide responsibility for CRA readiness?
A: Product security should own the evidence, vulnerability, and support data, while compliance should own scope interpretation and regulatory mapping. The two functions have to work from the same product catalogue, or the organisation will produce inconsistent answers about what is in scope.
👉 Read our full editorial: CRA scope for automotive suppliers: why product-by-product mapping matters
This post was modified 6 days ago by NHI Mgmt Group