Wind River and the EU Cyber Resilience Act

Reporting and conformance obligations

Important notice. This communication is provided for general information about the EU Cyber Resilience Act and Wind River’s related support. It is not legal advice and does not create any warranty, representation, contractual commitment, or assurance of conformance. CRA requirements and official implementation guidance may evolve. Organizations should assess their own obligations with qualified legal and compliance counsel and confirm current requirements against official European Union and ENISA sources.

This communication builds on the Wind River EU Cyber Resilience Act FAQ and provides additional information on reporting, manufacturer obligations, and support for customer due diligence.

At a glance

• Article 14 reporting requirements are enforced as of 11 September 2026 for in-scope products, regardless of when they were placed on the market.
• The broader CRA requirements, including essential cybersecurity requirements, conformity assessment, and CE marking, apply from 11 December 2027 to new or substantially modified software products/versions placed on the market from that date.
• Wind River has updated its product security processes to support its Article 14 obligations and is preparing its software products and development lifecycle for the requirements that are enforced from 11 December 2027.
• Wind River is supporting our customers’ CRA due diligence for our products that were placed on the market prior to 11 December 2027.

The timeline

Article 14 reporting obligations from 11 September 2026

Under Article 14 of the CRA, a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident affecting the security of its product, must notify the relevant authorities through the ENISA Single Reporting Platform (SRP) according to a staged timeline. The reporting obligations apply to all in-scope products irrespective of when they are placed on the market.

What Wind River is doing

Wind River updated its Product Security Incident Response Team (PSIRT) operations including coordinated vulnerability-disclosure processes to address the Article 14 requirements. Wind River is registered with the ENISA Single Reporting Platform (SRP) and uses the platform for required notifications. Wind River also maintains records supporting the timeliness and content of those notifications.

Wind River manages reporting and communication through its PSIRT for the EU CRA reporting obligations, along with other reporting obligations including customers and other coordination authorities. For more information, see the Wind River PSIRT Policy.

Conformance for products placed on the market from 11 December 2027

New or substantially modified and in-scope software releases placed on the market from 11 December 2027 will be required to meet the full conformity requirements of the EU CRA.

What Wind River is doing

Wind River has completed in-scope product classifications based on current guidance and has initiated assessments of Annex I essential cybersecurity requirements, and related manufacturer obligations. Building on its existing Product Development Life Cycle (PDLC), Wind River is implementing updates for in-scope new or substantially modified software releases placed on the EU market from 11 December 2027. Wind River is also preparing the conformity assessment approach for each in-scope product with internal control or notified body involvement according to the applicable product classification. These activities are intended to support the EU declaration of conformity and CE marking for applicable releases.

Wind River components placed on the market before 11 December 2027

While CRA essential cybersecurity requirements, conformity-assessment, and CE-marking obligations do not apply to software product versions placed on the market prior to 11 December 2027, the EU CRA requires due diligence for all components that a manufacturer integrates into their product, irrespective of when those components were placed on the market.

What Wind River is doing

Wind River supports our customers’ due diligence for their products through our Secure Development Lifecycle (SDL) Conformance Program directly aligned with the NIST Secure Software Development Framework (SSDF, NIST SP 800-218), including controls aligned to the due diligence requirements. Wind River supports Secure Software Development Conformance Statements that provide assurance of conformance to the SSDF.

Additional details and scope of the SDL Conformance Program is available on the Wind River Secure Development Lifecycle page.

Additional services

Wind River Professional Services can support customer CRA readiness activities through scoped engagements, including security and gap assessments, conformity-assessment support, security-certification support, and assistance with evidence packages for customer products.

Customer responsibilities

Wind River assurance materials and services are inputs that may support a customer’s due diligence and compliance activities. They do not transfer, assume, satisfy, or discharge the customer’s responsibilities as manufacturer of its finished product.

Learn more and get help

• Wind River EU Cyber Resilience Act FAQ
• Wind River Secure Development Lifecycle
• Wind River PSIRT Policy
• Regulation (EU) 2024/2847

To discuss specific products, evidence needs, or readiness activities, contact your Wind River account team or Wind River Professional Services.