Regulatory risk assessment vs. CRA cybersecurity risk assessment: what electronics manufacturers need to know

The regulatory risk assessment has a specific purpose: to demonstrate that the manufacturer has identified the essential requirements applicable to the product and documented how compliance with each of them is achieved. The legal basis is Decision 768/2008/EC, which requires the technical documentation to include "an adequate analysis and assessment of the risk(s)" across all conformity assessment modules.

The Blue Guide on the implementation of EU product rules elaborates: manufacturers must carry out a risk analysis to identify all possible risks the product may pose and determine the essential requirements relevant for the product. The analysis must be documented. In addition, the manufacturer must document how the identified risks are addressed, and where standards do not fully cover the requirements, by describing the alternative technical solutions adopted.

In this regulatory context, "harm" and "risk" have specific meanings that differ from everyday usage: harm is defined as non-compliance with an essential requirement, and risk is the combination of the probability of that non-compliance occurring and the severity of its consequences. This is not a threat model. It is not an assessment of what a malicious actor could do. It is an analysis of whether the product meets the regulatory requirements that apply to it.

For an electronics manufacturer placing products on the EU market, the regulatory risk assessment typically covers the essential requirements of RoHS, RED (if radio product) or EMC and LVD. Manufacturers of drones shall also cover Machinery and UAS Regulations.

The framework does not prescribe a format or methodology. The manufacturer is free to choose the structure, the depth, and the approach. What matters is that the assessment is adequate for the product and covers the necessary ground.

Based on the requirements in 768/2008 and the Blue Guide the risk assessment for an electronics product should address the following areas.

The starting point. Who will use this product? In what environment? Under what conditions? A Bluetooth-enabled consumer device used indoors by the general public presents different considerations from an industrial IoT gateway installed outdoors in a harsh environment and maintained by trained personnel. The user groups and operating environment determine which hazards are relevant and which standards are appropriate.

If the product is intended for vulnerable users (children, elderly, people with disabilities), the risk assessment must account for their specific needs. If the product will operate in conditions outside the scope of the applied harmonised standards those conditions must be identified and addressed.

The assessment must identify all essential requirements that apply to the product from every relevant directive. This is not a generic statement ("the product complies with all essential requirements"). It is a specific identification: which requirements, from which directive, apply to this specific product and its intended use.

The risk assessment should document which harmonised standards have been selected to address each essential requirement, and confirm that the applied standards are the versions currently referenced in the Official Journal (OJEU). If the manufacturer has applied a non-harmonised standard, the assessment must justify that choice and explain how compliance with the essential requirements is nonetheless demonstrated.

A frequent problem in practice is partial application of standards. A manufacturer may apply a harmonised standard but not all of its clauses or annexes. The risk assessment must identify which parts have been applied, which have not, and how the essential requirements covered by the unapplied parts are addressed through alternative means.

This is the most critical section and the one most frequently missing or inadequate. Harmonised standards are written to cover typical products in typical conditions. If a product has characteristics or features that were not anticipated when the standard was drafted, the standard alone may not be sufficient to demonstrate compliance.

The risk assessment must identify any exceptional product characteristics that might not be fully covered by the applied standards: unusual operating frequencies, non-standard power configurations, combined functionalities (multi-radio devices), software-configurable parameters that could take the product outside tested configurations, or the integration of a radio module into a host device that changes the electromagnetic or thermal environment.

When gaps are identified, the manufacturer must document how the essential requirements are met through alternative means: additional testing, engineering analysis, or design measures.

Once the applicable requirements, the selected standards, and any gaps have been identified, the risk assessment documents how each requirement is addressed. For requirements covered by harmonised standards listed in the OJEU and applied in full, the presumption of conformity applies. For requirements not covered, or where standards are applied only partially, the manufacturer must explain the technical solution adopted and provide evidence of compliance.

This is where the assessment functions as a compliance roadmap: a structured argument that connects the product's design and test evidence to every applicable essential requirement.

The regulatory risk assessment is reviewed in two very different contexts, depending on the conformity assessment route the manufacturer follows. Both apply the same standard of adequacy, but the timing, the reviewer, and the consequences differ.

When a manufacturer submits technical documentation for EU type examination under Module B of the RED, the risk assessment is one of the first documents the Notified Body reviews. It provides the evaluator with the manufacturer's own analysis of which essential requirements apply and how they have been met.

The evaluation is not a pass/fail checklist. The Notified Body assesses whether the risk assessment is adequate for the specific product. "Adequate" means that it covers all relevant essential requirements, identifies the right standards, acknowledges any gaps, and provides a coherent rationale for how compliance is achieved.

There are several points that evaluators consistently examine. The user groups and operating conditions must be realistic and consistent with the product's actual use. If a product is marketed for outdoor use but the risk assessment only considers indoor operation, or if it is marketed as suitable for children but the assessment does not consider their lower body mass for RF exposure, the assessment is inadequate.

The standards selection must be current and complete. Evaluators check whether the applied harmonised standards are the versions currently listed in the OJEU, whether they cover the full scope of the product's operation (all frequency bands, all operating modes, all power configurations), and whether the manufacturer has identified any requirements not covered.

Special characteristics must be addressed, not ignored. If the product has a non-standard antenna configuration, or if it can be software-reconfigured into modes that were not tested, or if it operates in a frequency band where the harmonised standard has restrictions in the OJEU, the risk assessment must acknowledge and address these points. An assessment that only lists the applied standards without considering the product's specific characteristics provides insufficient information for the evaluation.

If the Notified Body finds that the risk assessment is inadequate, it will issue clarification requests or additional information requests. The manufacturer must supplement or revise the assessment before the EU Type Examination Certificate can be issued. This adds time and cost to the conformity assessment process. In cases where the risk assessment is fundamentally insufficient, the entire evaluation may need to be reconsidered once a proper assessment is submitted.

Most electronic products are placed on the EU market through self-declaration under Module A, without Notified Body involvement. In that case, the risk assessment is never reviewed by a third party before the product reaches the market. However, it is still required to the same standard of adequacy, and it can be examined at any time by market surveillance authorities.

Market surveillance authorities can request the technical documentation. When they do, the risk assessment is a central element of what they review. The evaluation criteria are the same as those applied by a Notified Body: whether the assessment is adequate for the product, whether the applicable essential requirements have been identified, whether the standards selection is appropriate and current, and whether gaps are acknowledged and addressed.

The difference lies in the consequences. During a Notified Body evaluation, an inadequate risk assessment leads to clarification requests and delays before the certificate is issued. During a market surveillance inspection, an inadequate risk assessment is discovered after the product is already on the market. The consequences can be more severe: requests for corrective action, restriction of availability on the market, mandatory withdrawal or recall, and administrative penalties depending on the Member State's enforcement framework.

For manufacturers using Module A, the risk assessment is effectively the only documented evidence that the manufacturer has carried out the analysis required. A thorough and well-structured assessment is the strongest protection against enforcement action, precisely because there was no third-party review at the point of market entry.

The Cyber Resilience Act introduces a separate requirement. Article 13 requires the manufacturer to carry out a cybersecurity risk assessment of the product with digital elements and to take the outcome into account during the planning, design, development, production, delivery, and maintenance phases.

The purpose is different from the regulatory risk assessment. The CRA cybersecurity risk assessment asks: what are the cybersecurity risks associated with this product? What threats does it face? What could an adversary do to compromise the product's security? And how has the manufacturer addressed those risks through the design and the essential cybersecurity requirements of Annex I?

CRA article 13 requires the assessment to indicate whether and how the essential cybersecurity requirements of Annex I Part I apply to the product, and how they are implemented. It must consider the intended purpose and reasonably foreseeable use, the conditions of use (including the operational environment and the assets to be protected), and the expected duration of use.

The CRA Commission guidance clarifies that this is not an organisational risk assessment. The manufacturer's internal risk tolerance or commercial strategy is not relevant. The standard is whether identified cybersecurity risks have been sufficiently addressed through the implementation of the essential requirements, in light of the product's intended purpose and foreseeable use. Residual risk is an inherent outcome of risk treatment, but the existence of residual risk does not mean any risk may be accepted at the manufacturer's discretion. The product may only be placed on the market where residual risks have been sufficiently addressed.

The CRA FAQs add that manufacturers should use a threat modelling methodology appropriate to the product. Products intended for critical infrastructure may need to address nation-state actors and advanced persistent threats. Consumer products may use a different threat model. The regulation does not mandate a specific methodology, but the assessment must support the conclusion that all relevant risks have been identified and treated.

The regulatory risk assessment is fundamentally a point-in-time document. It is prepared before the product is placed on the market and updated when the product design changes or when the applicable standards or regulations are revised. Between those events, it is largely static.

The CRA cybersecurity risk assessment must be maintained and updated throughout the product's support period. New vulnerabilities emerge. The threat landscape evolves. A vulnerability that was not exploitable at the time of placement on the market may become exploitable as new attack techniques develop. The manufacturer's assessment must remain current, not as a reflection of the product's state at the time of market entry, but as a living analysis that is kept under review in accordance with Article 13(3).

This is a fundamental operational difference. The regulatory risk assessment is part of the conformity assessment at the point of market placement. The CRA cybersecurity risk assessment is an ongoing obligation that requires continuous attention throughout the product lifecycle.

Once the full application of CRA enters into force, all products with digital elements will need both types of risk assessment.

The regulatory risk assessment covers the non-compliance risk against the applicable EU legislation and applicable essential requirements. The CRA cybersecurity risk assessment covers the technical cybersecurity requirements: no known exploitable vulnerabilities, secure by default, protection of confidentiality and integrity, minimisation of attack surfaces, secure updates, and the vulnerability handling requirements of Part II.

However, there is an area where both meet today. Manufacturers applying the EN 18031 standard series for RED Article 3.3 cybersecurity compliance are already finding that the standard's methodology requires them to assess the cybersecurity risk profile of their product. EN 18031 asks the manufacturer to determine which security controls are applicable based on the product's risk level, its intended environment, and the assets it protects. To make that determination, the manufacturer effectively needs to evaluate the cybersecurity threats the product faces, the impact of a potential compromise, and the appropriate level of protection. Although the RED legal text does not formally require a standalone cybersecurity risk assessment as a separate document, the practical application of EN 18031 leads manufacturers toward one.

This is significant because it creates a bridge between the two worlds. Manufacturers who have already gone through EN 18031 compliance for RED 3.3 have started building the analytical foundation that the CRA cybersecurity risk assessment formalises and extends. The EN 18031 series also serves as the starting point for the CRA horizontal standards. What was an implicit exercise under RED 3.3 becomes an explicit, documented, and continuously maintained obligation under the CRA.

A practical approach for manufacturers is to maintain the regulatory risk assessment and the CRA cybersecurity risk assessment as separate documents with clear cross-references where the same product characteristics are relevant to both. Attempting to merge them into a single document is likely to create confusion and make both harder to evaluate, whether by a Notified Body or by a market surveillance authority.

A compliance gap assessment can identify where your product stands against both the current regulatory requirements and the incoming CRA obligations.

Given that the regulatory risk assessment has been a requirement for decades, it is striking how often it remains one of the weakest elements of the technical file. This section summarises the practical considerations that consistently determine whether an assessment is adequate, whether it is reviewed by a Notified Body during EU type examination or by a market surveillance authority after the product is on the market.

Start with the risk assessment, not with the test reports. The assessment should inform the test programme, not document it after the fact. Identifying the applicable essential requirements, selecting the standards, and identifying any gaps before testing begins produces better coverage and reduces the likelihood of discovering gaps after test reports have been issued. A risk assessment written retrospectively to justify an already finalised product is less useful and less defensible under review.

Be specific about the product. Generic assessments that could apply to any product provide insufficient information. The assessment must reflect the specific characteristics of the product: its radio technologies, its operating modes, its power configurations, its intended environment, and its user groups. Copy-paste templates applied without adaptation are one of the most frequent sources of clarification requests during Notified Body evaluations, and one of the most common weaknesses identified during market surveillance inspections.

Document the gaps explicitly. When a harmonised standard does not fully cover an essential requirement, or when the product has a characteristic not anticipated by the standard, document the gap and the solution. An assessment that acknowledges gaps and addresses them is stronger than one that ignores them.

Consider the complete operating envelope. Para productos con parámetros configurables por software, múltiples tecnologías radio o configuraciones modulares, la evaluación de riesgos debe abordar todos los estados posibles, no solo la configuración por defecto que fue ensayada. Un dispositivo multi-radio (Wi-Fi, Bluetooth, celular) debe tener en cuenta la coexistencia y la posible interacción entre sus tecnologías radio, no evaluar cada una de forma aislada.

Keep it current. When standards are updated, when new regulatory requirements come into force (such as the RED Article 3.3 delegated acts), or when the product design changes, the risk assessment must be reviewed and updated accordingly. A risk assessment prepared against a superseded version of a harmonised standard is no longer adequate.