Understanding the Cyber Resilience Act and X-Rite’s Approach
Connected hardware and software bring greater automation, visibility, and efficiency to modern color workflows. They also make cybersecurity an increasingly important part of product design, maintenance, and support.
The European Union’s Cyber Resilience Act establishes a common framework intended to improve the security of products with digital elements and give customers greater confidence in the technology they use.
For X-Rite customers, the Cyber Resilience Act is more than a regulatory milestone. It reinforces the importance of choosing solutions that are designed, supported, and maintained with cybersecurity in mind throughout their lifecycle.
What Is the Cyber Resilience Act?
The Cyber Resilience Act, or CRA, is European Union legislation that introduces mandatory cybersecurity requirements for products with digital elements made available in the EU. Depending on how a product is used and connected, this may include hardware, embedded firmware, software, and related digital components.
The regulation is designed to address cybersecurity throughout the product lifecycle rather than only at the point of sale. Manufacturers must consider security during product planning, design, development, production, maintenance, and vulnerability handling.
The CRA entered into force in December 2024. Reporting requirements for actively exploited vulnerabilities and severe security incidents began in September 2026. The regulation’s main product requirements will apply beginning in December 2027.
What Does the CRA Require?
At a high level, the Cyber Resilience Act requires manufacturers to take a “secure by design and secure by default” approach, building cybersecurity into products from the outset and providing secure default configurations. Manufacturers must evaluate cybersecurity risks and apply appropriate protections to products within its scope. Requirements may include:
- Designing products with cybersecurity considerations built in from the beginning
- Providing products without known exploitable vulnerabilities
- Using secure default configurations where appropriate
- Reducing unnecessary access points and potential attack surfaces
- Protecting against unauthorized access, data loss, manipulation, or misuse
- Establishing processes to identify, assess, and address vulnerabilities
- Providing security updates during a defined support period
- Maintaining appropriate technical documentation and product security information
- Reporting actively exploited vulnerabilities and severe security incidents within required timeframes
- Communicating relevant security information, updates, and mitigations to customers
The exact conformity assessment and documentation requirements can vary based on a product’s classification and risk level. Products that meet applicable CRA requirements will use the CE marking to indicate conformity for the EU market.
How Is X-Rite Preparing for the Cyber Resilience Act?
X-Rite is taking a cross-functional approach to CRA readiness. Teams across X-Rite are working together to assess how the regulation applies across the X-Rite portfolio.
This work includes:- Reviewing connected hardware, firmware, software, and supporting digital components
- Assessing cybersecurity risks
- Strengthening vulnerability management processes
- Defining lifecycle and proactively updating products to enhance security and address identified vulnerabilities
X-Rite has also established processes that help customers and security researchers report potential product security concerns. Reports are reviewed through the appropriate product security channels so X-Rite can assess the issue, coordinate a response, and provide relevant guidance when needed.
Because CRA applicability can depend on the product, version, configuration, support status, and date it is placed on the EU market, customers should not assume that one statement applies to every X-Rite solution. Product-specific compliance information will be communicated through approved product, lifecycle, support, or regulatory documentation as it becomes available.
What Should X-Rite Customers Do?
Keep supported products current by installing the latest approved firmware, software, and security updates. Customers should also review lifecycle notices and begin planning transitions for products approaching end of sale, end of service, or the conclusion of their support period. When evaluating new technology, ask how cybersecurity is addressed throughout the product lifecycle, how vulnerabilities are reported, how updates are delivered, and how long the solution will be supported. These questions are valuable even when CRA compliance is not legally required in the customer’s region.
If you have a question about the CRA status of a specific X-Rite product, contact X-Rite for the latest approved information. Product compliance may vary by product, version, configuration, and market timing.
A Stronger Foundation for Product Security
The Cyber Resilience Act creates a more consistent foundation for cybersecurity across connected hardware and software. For customers, it supports greater transparency, stronger vulnerability management, clearer lifecycle expectations, and more confidence in the solutions they choose.
X-Rite is actively preparing for the regulation by embedding security and compliance considerations into product development, support, documentation, and customer communication processes. As product-specific information is finalized, X-Rite will provide guidance through the appropriate product and lifecycle channels.
To learn more, get in touch with our Color Experts.
