In 2018 a cookie banner appeared on a website run out of Ohio. No American law required it. The General Data Protection Regulation did, and the company behind the site had done the arithmetic: running one privacy regime for European visitors and a laxer one for everyone else cost more than raising the global floor to the line Brussels had drawn. Multiply that decision across every firm that touches the European market and you get the Brussels Effect, the well-documented pattern where the rules of a market large enough and strict enough quietly become the cheapest rules to build to, everywhere. It happened with privacy. This essay is a forecast that it is about to happen again, this time to the security of physical products, and that the instrument is Regulation (EU) 2024/2847, the Cyber Resilience Act.
To be clear about what is fact and what is forecast: the CRA is real, in force since 10 December 2024, with its reporting duties biting from 11 September 2026 and its full requirements, including CE marking, from 11 December 2027. Those dates are settled law. Everything past them in this piece is analysis. I am not claiming the CRA has already become a global standard. I am arguing that the same economic logic that globalised GDPR points hard in that direction, and that a product organisation planning capital investment now should price that trajectory in rather than bet against it.
The forking decision every global vendor is about to make
Consider a firm that sells a programmable logic controller, an industrial router, or a connected sensor into forty countries. The CRA hands its engineering leadership a single, concrete choice. Option one is to fork: build a compliant variant for the European market that ships with a secure-by-default configuration, carries a machine-readable software bill of materials, handles vulnerabilities on a defined clock, and commits to a stated support period, then keep a cheaper, looser build for everywhere else. Option two is to converge: raise every unit to the European line and ship one product worldwide.
Forking sounds like the frugal answer until you cost it. A fork is not one weaker firmware image. It is two bills of materials to track, two test and validation regimes, two update pipelines to staff, two support-period clocks to honour, and a permanent risk that a non-EU unit crosses a border and lands you in front of a market-surveillance authority with the wrong build. For most industrial vendors the maintenance overhead of deliberately sustaining an insecure second line exceeds the marginal cost of simply making the compliant line the only line. The rational move, the same one that put a GDPR banner on an Ohio website, is to converge. When enough vendors converge, the Annex I baseline stops being a European obligation and starts being the specification the global supply chain is built around.
What industrial design looks like on the far side
Assume convergence wins across enough of the market. Here is the world it produces by 2030, argued as prediction rather than reported as fact.
Secure-by-default stops being a compliance checkbox and becomes a competitive moat. Annex I requires a product to be made available with a secure by default configuration and without known exploitable vulnerabilities. Once a critical mass of vendors ships that globally, a procurement officer in a market with no equivalent law starts asking for it anyway, because the compliant products are the ones in front of them and the datasheet now carries the claim. The vendor who built to the line early answers the RFP without re-engineering. The one who kept a loose global build is now the expensive latecomer, funding the convergence its competitor already amortised.
The software bill of materials follows the same curve. Annex I obliges manufacturers to identify and document the components in their products, at minimum the top-level dependencies, in a commonly used machine-readable format. By 2030 a product shipped without an SBOM reads the way a product shipped without a datasheet reads today: not illegal everywhere, but a signal that the vendor either does not know what is inside their own device or would rather you did not. SBOM becomes table stakes, the price of being taken seriously, not a differentiator.
The deepest change is to the economics of the product lifecycle. The CRA requires a manufacturer to declare a support period and to handle vulnerabilities and ship security updates across it, a duty anchored in Article 13(8). That single obligation kills the industrial habit of shipping a controller and walking away for fifteen years. Support is now a costed, contractual liability that has to be priced into the unit and budgeted across the fleet. Products designed after that liability sinks in will carry longer, better-funded maintenance commitments and shorter tails of orphaned firmware, because abandonware is no longer free to the manufacturer that made it. This is the mechanism that finally puts real weight behind the phrase secure-by-design, whose engineering substance I worked through from the conformity side in EP 7.05.
The floor is not fixed, which is the point
A common objection to any Brussels Effect forecast is that vendors will build to the rule once, freeze, and wait it out. The CRA is written to prevent exactly that. Article 61, titled Exercise of the delegation, confers on the Commission a standing power to adopt delegated acts, granted for five years from 10 December 2024 and renewable, reaching into the classification of critical products, the technical particulars, and the reporting detail. The list of what counts and the specifics of what compliance demands can move without reopening the whole regulation. That matters for the forecast because a living standard strengthens convergence rather than weakening it. Re-forking a global product every time the floor rises is more painful than tracking one baseline as it ratchets, so the delegated-act engine gives vendors a continuing reason to stay converged on the European line rather than drift back off it.
None of this bites without consequences, and the CRA supplies them. The penalty architecture, which I broke down in EP 8.01, is what converts a design principle into a board-level number and gives the whole forecast its teeth. A standard with real financial force behind it in the largest single market is precisely the kind of standard that globalises.
Here is the horizon laid out as a readiness roadmap. Treat the milestones through 2027 as fixed dates and the 2028–2030 rows as the trajectory this essay argues for, so a product organisation can see what to have done, and by when.
| Year | Regulatory milestone (fact through 2027, forecast after) | What a product organisation should have done by then |
|---|---|---|
| 2026 | 11 September: reporting duties apply. Actively exploited vulnerabilities and severe incidents must be notified. | Coordinated vulnerability disclosure and a reporting runbook wired and rehearsed; SBOM generation running in the build pipeline, not bolted on later. |
| 2027 | 11 December: full application. CE marking required to place a product on the EU market. | Secure-by-default shipping as the shipped state; support period declared per product; conformity route chosen and the technical file assembled. |
| 2028 | First full year under active market surveillance and enforcement. | The global product line converged on the CRA baseline; deliberately weaker non-EU variants retired or aligned; support obligations funded across the fleet. |
| 2029 | Harmonised standards mature; delegated acts under Article 61 refine scope and technical detail. | Design-to-standard baked into the development lifecycle; SBOM depth pushed past top-level dependencies; a process to absorb a rising floor without re-forking. |
| 2030 | Forecast: the CRA baseline is the de facto specification industrial buyers request by default, inside and outside the EU. | Secure-by-default carried as a sales asset rather than a compliance cost; support economics priced into every product line from design onward. |
You can map your own product portfolio against these baseline requirements in the conformity workspace, and the underlying obligations sit in the CRA reference.
This is where the fifty-episode programme closes, so let me end on the one thing the roadmap cannot decide for you. The dates are fixed and the economics are, I think, close to inexorable. What remains open is posture. Some organisations will read a regulation and a set of buyer expectations converging and choose to get in front of both, treating the European floor as the product they wanted to build anyway. Others will hold their weaker global line until an RFP they cannot answer, a border seizure, or a fine forces the same convergence at a worse price and on someone else's clock. The requirements will be met either way; that much the CRA guarantees. The only question the regulation leaves entirely to you is whether your organisation reaches the 2030 baseline as the firm that led the market there, or as the one the market finally dragged.