Commitment to Supporting the EU Cyber Resilience Act (CRA)
Commitment to Supporting the EU Cyber Resilience Act (CRA)
As cybersecurity regulations evolve, Qualcomm Technologies, Inc. (Qualcomm Technologies) is committed to supporting customers and partners in navigating compliance requirements for their products that leverage Qualcomm Technologies products.
For Qualcomm Technologies products that fall within the scope of the European Union Cyber Resilience Act (CRA), Qualcomm Technologies’ plans address the CRA requirements for those products, including providing customers with product-specific conformance documentation designed to support their own CRA conformity and compliance efforts.
Supporting Customers Through CRA Requirements
Qualcomm Technologies’ approach is focused on helping customers build products with confidence by providing transparent documentation, security processes, and compliance artifacts which are designed to be aligned with CRA requirements.
Our compliance strategy is built on three foundational pillars:
Essential Cybersecurity Requirements
Qualcomm Technologies plans to address applicable CRA cybersecurity requirements for products in scope, including security protections, vulnerability management practices, software update mechanisms, and measures intended to support confidentiality and integrity.
Harmonized Standards
Qualcomm Technologies intends to apply relevant CRA horizontal harmonized standards that are broadly applicable to products with digital elements.
Product-Specific Standards
Where applicable, Qualcomm Technologies will aim to align products with relevant vertical or category-specific requirements based on CRA classifications and product attributes.
What Customers Can Expect
For in scope products, Qualcomm Technologies plans to provide a CRA conformance package containing the technical documentation and evidence designed to support compliance activities. These packages are intended to help OEMs and ecosystem partners efficiently leverage Qualcomm Technologies documentation as part of their own compliance processes.
The conformance package may include:
- Product descriptions and version information
- Design and development documentation
- Vulnerability handling processes
- Security risk assessments
- Product support lifecycle information
- Applicable standards and specifications
- Security validation and test evidence
- Conformity assessment documentation
- Software Bill of Materials (SBOM) artifacts
Qualcomm Technologies is sharing this preliminary information as a resource to help customers understand Qualcomm Technologies’ current plans to support customer-led compliance activities under the CRA. These plans are still evolving and may change as Qualcomm Technologies further evaluates its approach, including potential deliverables, timelines, and implementation details. Customers remain solely responsible for determining and satisfying all CRA and other legal and regulatory obligations applicable to their own products placed on the EU market. Nothing in this communication constitutes legal advice or a commitment by Qualcomm Technologies to provide any specific deliverable, functionality, update, certification, assessment, or compliance support.
For clarity, this communication does not change the terms that govern Qualcomm Technologies or its affiliates’ supply of any in-scope products. Those terms, including the parties’ respective rights, obligations, and remedies, continue to be governed by the applicable definitive agreement(s) between our companies.
Software Bill of Materials (SBOM) Transparency
As part of Qualcomm Technologies’ CRA support strategy, SBOMs are planned for applicable software releases and would follow commonly used machine-readable industry formats such as SPDX. This approach aims to help improve software transparency and enables customers to better understand software component composition and dependencies.
Qualcomm Technologies’ SBOM approach is designed to align with CRA expectations for software composition visibility while supporting industry best practices for software supply chain security.
Delivering Compliance Resources
Qualcomm Technologies plans to make compliance resources available through scalable delivery mechanisms designed to simplify customer access and product traceability. Key elements of this approach would include:
Centralized access to product-specific compliance documentation through Qualcomm Package Manager (QPM)
SBOM delivery alongside major software releases
Product-to-document mapping to help customers locate the appropriate compliance artifacts for the technologies they license and deploy
Moving Forward
Qualcomm Technologies is actively working toward preparing CRA conformance packages for products within scope ahead of full CRA enforcement. The objective is to provide customers with the documentation and evidence needed to support their own conformity assessment processes and accelerate readiness for regulatory requirements.
By combining cybersecurity-focused product development, standards-based compliance practices, transparent software documentation, and scalable customer support resources, Qualcomm aims to help customers confidently develop, deploy, and maintain secure connected products for the European market.
For more information, please reach out to your Qualcomm representative who can provide more details related to specific products.
