Cyber Resilience Act accelerates updateable industrial and automotive platforms

The EU Cyber Resilience Act (CRA), in force since December 2024, obliges manufacturers of connected products to report exploited vulnerabilities within 24 hours and to achieve full compliance by December 2027, with penalties of up to €15 million or 2.5 % of annual turnover. Key requirements include secure over‑the‑air (OTA) updates, a maintained software bill of materials (SBOM) and continuous vulnerability management.

These regulatory pressures are prompting a shift from static embedded hardware to adaptable, software‑centric designs. In the industrial sector, 75 % of manufacturers cite cybersecurity as the top barrier to Industry 4.0 adoption, driving investment in long‑term maintainable systems.

The automotive industry is following a similar path with software‑defined vehicles (SDV). Platform‑based, cloud‑native and virtualisation tools—such as the AWS‑based SDV Accelerator—allow developers to test, simulate and deploy software updates rapidly, using digital twins that mimic real vehicles. Faster development cycles and OTA capability are expected to boost innovation and market appeal.

The broader market for edge AI supports this trend; the sector reached roughly $25 billion in 2025 and is projected to exceed $118 billion by 2033, reinforcing the demand for updatable, secure platforms across manufacturing and automotive domains.