28/10/2025
Have you ever heard about the Cyber Resilience Act?
On 10 October 2024, the Council of the EU adopted a new law establishing robust cybersecurity requirements for products with digital elements. This means that hardware and software devices—especially those connected to networks or other devices—must be designed, developed, produced, and maintained with security in mind across their entire lifecycle.
🔐 What is the Cyber Resilience Act (CRA)?
It sets a harmonised EU-wide standard for cybersecurity of digital products (hardware and software), to close gaps and avoid overlapping rules across member states.
Products bearing digital elements (e.g. IoT devices, smart appliances, networked systems) must comply with these standards before entering the market.
It introduces the CE marking as a signal that the product meets these security requirements.
The regulation will eventually apply (some provisions earlier, full enforcement within 36 months after entry into force).
🛡️ Link to Prevention of Online Harassment & Gender-based Violence
Though this regulation is seemingly “technical,” it holds real implications for social safety, especially in online contexts. Here’s how:
- Harder for attackers to exploit device vulnerabilities
Many harassment campaigns use compromised devices (e.g. botnets, hijacked cameras, smart home devices) as vectors or infrastructure. If all devices meet stronger security requirements from the start, attackers have fewer weak points to exploit.
- Better protection of personal data and identity
Secure-by-design standards discourage vulnerabilities that could expose sensitive personal data (photos, location, communications), which are often weaponised in harassment or abuse, particularly against women and marginalized groups.
- Trust in communication and platform integrity
Strong cybersecurity in devices helps ensure the infrastructure of online platforms (apps, social tools, connected systems) remains more resilient. Attackers have less chance to intercept, tamper, or falsify communications used in “doxxing,” impersonation, or coordinated abuse.
- Empowering victims and defenders
When digital systems are more secure, activists, survivors, NGOs, and community organisations can use tools (apps, surveillance alarms, reporting platforms) with less fear of digital retaliation or uncontrolled exposure.
📌 In short: The Cyber Resilience Act is more than a regulation for tech manufacturers — it contributes to safer digital spaces. By raising the security floor of devices used by millions, it indirectly helps curb some of the tools that enable harassment, abuse, and gender-based violence.
At SHIELD Consortium, we pay close attention to how security frameworks intersect with social risks. Would your organization benefit from a workshop on “security by design & social protection” in digital tools? Let us know in the comments.
To know more about: https://www.consilium.europa.eu/en/press/press-releases/2024/10/10/cyber-resilience-act-council-adopts-new-law-on-security-requirements-for-digital-products/
