Cybersecurity Across the Product Lifecycle

For years, cybersecurity was treated as something that could be strengthened over time, issues patched after release, vulnerabilities handled as they emerged, compliance addressed later. That approach no longer holds. As products become more software-defined and dependent on multiple vendors and third-party components, the attack surface grows, and attacks increasingly target operational technology in vehicles, hospitals and factories, not just servers.

The result is rising demand for built-in security, Software Bills of Materials (SBOMs), CVE transparency, and growing scrutiny of the software supply chain. Security has converged into a primary concern for connected systems, and increasingly it is being written into law.

At the same time, regulators are raising expectations around secure development practices, SBOM transparency, vulnerability management, and long-term security support. Requirements introduced through regulations such as the EU Cyber Resilience Act are making cybersecurity not only a technical consideration, but also a product, compliance, and business requirement.

Regulation (EU) 2024/2847 establishes cybersecurity requirements for products with digital elements placed on the EU market, tying security to the full lifecycle of the product — not just launch. Vulnerability-reporting obligations begin 11 September 2026, with full compliance required by 11 December 2027. Critically, the CRA covers far more than architecture: vulnerability handling, updates, reporting, documentation and conformity assessment throughout the supported life of the product.

Regulation (EU) 2024/1689 makes cybersecurity an essential requirement of AI system safety. Under Article 15, high-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity, backed by risk management, technical documentation and conformity assessment across the lifecycle. For AI embedded in regulated products such as robotics and industrial machinery, these obligations apply from 2 August 2028 (with standalone high-risk systems from 2 December 2027). For builders of intelligent embedded systems, secure and deterministic foundations are becoming a legal expectation, not just an engineering preference.

At QNX, cybersecurity is foundational: it influences how products are designed, built, tested, and maintained, and QNX contributes to cybersecurity working groups and standards bodies to stay ahead of emerging threats. The QNX cybersecurity framework maps directly to core CRA requirement areas:

The first step is to determine whether the EU CRA applies to your products. Identify which of your offerings qualify as products with digital elements and whether any fall into one of the CRA's regulated product classes. Then start with a gap assessment to identify where your processes and product lifecycle activities do not meet EU CRA requirements.

Yes. For products within the scope of the EU CRA, the CE marking is the means by which a manufacturer declares that the product complies with the applicable EU CRA requirements, as well as any other relevant EU legislation requiring CE marking. It is important to note that the EU CRA does not introduce a separate "CRA certification mark." Instead, compliance is demonstrated through the existing CE marking framework, supported by the EU Declaration of Conformity.

Engineering and compliance should focus on one overarching question: If we had to demonstrate CRA compliance today, what evidence could we provide, and what capabilities or documentation are still missing? This mindset helps identify gaps before they become compliance risks.

The top 3 practical questions could be:

1. Does the CRA apply to our products, and what are our obligations?
2. Where are the biggest gaps between our current practices and the CRA requirements?
3. Can we demonstrate compliance with evidence, or do we need to build new capabilities (e.g., SBOMs, vulnerability management, security updates, documentation)?

Start by contacting QNX Security Services or exploring our CRA-focused product resources, presentations, webinars, and blogs. We can help customers understand which CRA requirements QNX can support and which remain the product manufacturer’s responsibility.

QNX can reduce the compliance workload by providing security capabilities and supporting evidence, including SBOMs, vulnerability notifications, security documentation and lifecycle updates. For long-lifecycle products, extended and post-end-of-life support can also help maintain security through continued vulnerability monitoring and security support beyond the standard support period.

For cybersecurity-related questions or to report a security issue, contact the QNX security team at security@qnx.com. For general enquiries about QNX security products, services or support, customers can also reach the appropriate team through our contact form.