As part of the European Cyber Resilience Act (CRA)*, AREAL is continuing its cyber compliance programme by strengthening Topkapi’s cybersecurity framework. The work carried out in-house has already focused on two complementary areas to meet the first deadline**: the assessment of software classification and the management of incidents and vulnerabilities.
An initial assessment has been carried out to determine Topkapi’s classification under the CRA. This helps to clarify the applicable requirements and to guide the preparation of the checks and the conformity assessment.
At the same time, Topkapi’s incident and vulnerability management procedure has been updated. This initiative aims to provide a clearer framework for handling reports, clarify responsibilities and improve the traceability of actions. This work helps to ensure a structured response to security incidents and compliance with applicable notification requirements.
These developments form part of a gradual process to improve Topkapi’s safety, with the ultimate aim of obtaining EC (European Conformity) marking for the product under the CRA. This process unites the teams around a common goal: to demonstrate Topkapi’s compliance with the requirements of the regulation and to strengthen the long-term trust of our customers and partners.
*What is the CRA (Cyber Resilience Act)?
The Cyber Resilience Act (CRA) is European Regulation No. 2024/2847, which came into force in December 2024 and imposes strict cybersecurity requirements on all products containing digital components (hardware and software) marketed within the European Union. Its main aim is to ensure that these connected devices or applications remain secure throughout their lifecycle, thereby reducing vulnerabilities that could be exploited by cybercriminals.
**What is the timetable for implementation?
• 11 September 2026: The obligation to report actively exploited vulnerabilities or major security incidents to the European Union Agency for Cybersecurity comes into force.
• 11 December 2027: The legislation becomes fully applicable. All products made available on the market after this date must be fully compliant, failing which penalties will apply.
