Does the Cyber Resilience Act Apply to AI Startups?
Learn if the EU CRA applies to AI Startups, what the core compliance requirements are, and how to start preparing your engineering teams automatically.
Core Definition
Yes. The EU Cyber Resilience Act applies directly to AI Startups as they fall under the definition of "products with digital elements." An AI model wrapped in an API is a product with digital elements the moment it ships to EU customers, regardless of how the model was trained. This means your software must meet mandatory cybersecurity requirements to be distributed in the EU market.
Key Compliance Steps for AI Startups
- Determine Classification: Check if your AI Startups falls under the default category or Class I/Class II, which dictate stricter conformity assessment paths.
- Perform Risk Assessment: Map out the attack surface for your software and document the mitigations for the "secure by design" requirement.
- Implement Vulnerability Reporting: Provide a 24-hour reporting mechanism to ENISA for actively exploited vulnerabilities.
- Generate an SBOM: Ensure all dependencies used in your AI Startups are documented in a machine-readable Software Bill of Materials.
- Avoid the Common Pitfall: Founders conflate AI Act obligations (model risk) with CRA obligations (product cybersecurity) — you need both, not one instead of the other.
How This Plays Out in Practice
An AI model wrapped in an API is a product with digital elements the moment it ships to EU customers, regardless of how the model was trained.
What to Watch For
Founders conflate AI Act obligations (model risk) with CRA obligations (product cybersecurity) — you need both, not one instead of the other.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to AI Startups.