The European Union’s Cyber Resilience Act (CRA) and NIS2 Directive establish cybersecurity requirements for digital products and organisations operating across critical sectors, including aviation.
The CRA’s vulnerability and incident-reporting obligations began on 11 September 2026, ahead of the regulation’s wider application date of 11 December 2027. Meanwhile, in member states that have transposed it, the NIS2 Directive already requires covered organisations to manage cybersecurity risks and report significant incidents under the relevant national legislation.
What is the Cyber Resilience Act?
The Cyber Resilience Act, established by Regulation (EU) 2024/2847, introduces additional cybersecurity requirements for hardware and software products with digital elements made available on the EU market.
The regulation places obligations on manufacturers and other economic operators. This includes requirements to address cybersecurity risks during product design, development and production. Manufacturers must also establish processes to handle vulnerabilities throughout the expected lifecycle of the products.
All products must meet the essential cybersecurity requirements before being placed on the market; their classification determines which conformity assessment procedure applies. The regulation also addresses security updates, technical documentation and the provision of information to users.
Since 11 September 2026, manufacturers covered by the CRA have had to report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. An initial early warning must be submitted within 24 hours of the manufacturer becoming aware of the issue, followed by a notification within 72 hours.
The reporting process uses the CRA Single Reporting Platform, established and managed by the EU Agency for Cybersecurity (ENISA), with notifications submitted simultaneously to the relevant national computer security incident response team (CSIRT) and ENISA.
The broader requirements of the CRA are scheduled to apply from 11 December 2027.
How Does the CRA Relate to Aviation Cybersecurity?
Airports, airlines and air traffic management providers use a range of connected hardware and software. This includes operational systems, digital equipment and supporting airport infrastructure. Manufacturers and suppliers need to establish whether their products are covered by the CRA and what requirements apply to their development, vulnerability handling and reporting processes.
The CRA primarily places obligations on manufacturers of products with digital elements, including hardware and software that can connect directly or indirectly to another device or network. This means the regulation is particularly relevant to companies manufacturing or supplying connected equipment and software for use in aviation.
However, an airline or airport does not become subject to the CRA simply because it uses digital products. For example, the CRA does not apply to products certified under the EASA Basic Regulation, (EU) 2018/1139, such as certified aircraft, engines, parts and equipment. This includes certified unmanned aircraft.
The CRA operates alongside established aviation-specific cybersecurity requirements. The European Union Aviation Safety Agency’s (EASA) Part-IS rules already require certain aviation organisations to identify and manage information security risks that could affect aviation safety.
The EU has also updated its civil aviation occurrence-reporting framework. Commission Implementing Regulation (EU) 2026/1821, which took effect in August 2026, adds specified information security occurrences to the existing reporting framework. These include certain incidents involving compromised data, malware infections and distributed denial-of-service attacks.
While the CRA focuses on cybersecurity requirements for digital products, Part-IS addresses information security risks within covered aviation organisations. The NIS2 Directive also provides a separate framework for cybersecurity risk management by certain organisations in critical sectors, including air transport.
What Does This Mean for the Aviation Industry?
Manufacturers and suppliers of connected hardware and software should assess whether their products fall within the CRA’s scope and identify the relevant requirements. This includes establishing processes for vulnerability management, security updates and incident reporting, ahead of the regulation’s wider application in December 2027.
Airlines, airports and air traffic management providers, meanwhile, need to determine which cybersecurity obligations apply to their own operations. These may include the aviation-specific Part-IS rules, NIS2 requirements under national legislation, and applicable occurrence-reporting obligations.
The interaction between these frameworks is highly relevant when aviation organisations rely on third-party technology suppliers. Organisations need to consider both the security of the products they procure and the risks associated with their wider operations.
With the CRA’s broader requirements due to apply from December 2027, aviation organisations and suppliers need to establish which rules apply to their products and activities and ensure they have processes in place to meet the relevant deadlines.
