Embedded Software: Definition, CRA Obligations and Business Impact for Swiss Manufacturers

Embedded Software: Key Takeaways

• Embedded software is hardware-bound code with a fixed execution environment and real-time constraints. It runs on microcontrollers, industrial controllers or connected devices and is inseparably coupled to the underlying hardware.
• The Cyber Resilience Act (Regulation EU 2024/2847) classifies embedded systems and software as products with digital elements. From September 2026, manufacturers have to report actively exploited vulnerabilities to ENISA within 24 hours and maintain a documented vulnerability disclosure process.
• Swiss companies that supply products with embedded software into the EU fall fully under the CRA. From December 2027, breaches carry substantial fines.
• Axisbits develops digital products with senior sign-off on every line of code, DevOps-backed security checks, optional penetration testing and DSG compliance. For SMEs that need to get their software products CRA-ready, Axisbits takes on the technical and strategic responsibility end to end.

What is embedded software?

Embedded software is specialized code developed exclusively to control a particular hardware system. Unlike conventional application software, it runs on a fixed processor with defined resources, reacts to external signals, and is generally invisible to the end user.

Embedded software sits inside devices that fulfil a defined function. Examples include sensor systems in industrial or medical installations (PLC controllers, SCADA components), automotive electronics (ECUs, ADAS systems), IIoT sensors and smart home devices.

The common denominator is that these devices fulfil a defined function, that the software is matched directly to the hardware, and that it runs across the entire product lifecycle.

How Does Embedded Software Differ From Conventional Application Software?

What does the Cyber Resilience Act require of embedded software?

The Cyber Resilience Act (CRA) obliges manufacturers of products with digital elements to apply security by design, to manage vulnerabilities continuously across the entire product lifecycle, and to provide free security updates for at least five years.

If you place a connected device with embedded software on the market in the EU, you have to carry out a conformity assessment, maintain a complete Software Bill of Materials (SBOM), and obtain CE marking to the CRA standard.

Which CRA Deadlines Apply to Manufacturers, and When?

Which Technical Obligations Does Security by Design Involve for Embedded Software?

Security by design means security requirements are anchored in the concept phase already, rather than arriving as an after-the-fact review:

• Software Bill of Materials (SBOM): a complete listing of all software components and dependencies, machine-readable and kept current.
• Threat modeling: a documented threat analysis before development starts, updated regularly.
• Secure default configuration: no insecure default passwords, no unnecessarily open interfaces on delivery.
• Update mechanism: cryptographically secured over-the-air updates for the entire product lifecycle.
• Vulnerability disclosure process: a defined internal and external channel for security reports, with predetermined response deadlines.

An analysis of the existing software architecture as part of a software audit additionally helps surface any compliance gaps that are already there.

What are the consequences of the CRA for Swiss embedded software manufacturers?

Swiss companies that distribute products with embedded software into the EU fall fully under the CRA, even without an EU establishment. The CRA applies at the place where the product is placed on the market. That has direct consequences for liability, licensing models and authorized representation.

• Product liability: security gaps that the manufacturer should have known about and fixed can lead to recalls, sales bans and fines of up to EUR 15 million or 2.5 % of global annual turnover.
• Licensing models: the obligation to provide updates for at least five years pushes many vendors away from one-off purchases towards maintenance contracts or subscription models, because ongoing security patches have to be funded predictably.
• Swiss SMEs without an EU establishment must appoint an authorized EU representative by December 2027, who acts as the point of contact for EU market surveillance authorities and coordinates reports via the ENISA Single Reporting Platform.

How do I prepare my company for CRA-compliant embedded software?

You start your route to compliant embedded software with a product screening, secure development from the very first moment, plan the update processes, and appoint an EU representative.

• Product screening: establish which of your products fall under the CRA. Connected devices with a software component almost always do.
• Security by design: integrate threat modeling and an SBOM from the first development phase. Your IT strategy sets the frame within which security requirements are then prioritized.
• Update processes: plan for cryptographically secured over-the-air updates and an internal vulnerability disclosure process. System architectures that follow clean architecture principles make later security patches considerably simpler.
• Mandate an EU representative: plan for an EU establishment, or appoint an external authorized representative.

Distributing embedded software in EU compliance with Axisbits

For Swiss manufacturers supplying products with embedded software into the EU, there is no way around the Cyber Resilience Act. The decisive question is whether your software team has the internal capacity and security know-how to hold those requirements reliably across the entire product lifecycle. Axisbits can help you with that:

• Senior sign-off on every line of code: one accountable address for the whole of your code.
• ISO 27001 certification and DSG compliance, with an optional penetration test on every ship cycle.
• Full code ownership: the code belongs entirely to you, and the whole architecture is documented, transferable and not tied to us.

Book your free intro call. In 30 minutes we clarify together how to make your embedded software ready for the EU and world markets. You get an honest assessment of development time and costs, with no sales pressure.

{{fs-btn-cta}}