CRA and Pentests: What the Cyber Resilience Act Requires in Security Testing

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, has been in force since December 2024 and applies in full from 11 December 2027; the reporting obligation under Article 14 starts on 11 September 2026. This article deals with the duty that causes the largest operational effort: regular security testing. Taking it seriously leads to penetration testing, and looking for German implementation guidance leads to BSI TR-03183.

The Testing Obligation in Annex I of the CRA

Annex I of Regulation (EU) 2024/2847 defines the product requirements in Part I (secure by design, secure default configuration, access protection) and vulnerability handling across the product lifecycle in Part II. The central provision is point 3: manufacturers must "apply effective and regular tests and reviews of the security of the product with digital elements".

The CRA prescribes no method. It is risk-based: under Article 13(3), the testing depth follows from the risk assessment, which builds on the intended purpose and the reasonably foreseeable use of the product. That does not license minimalism: Annex VII point 6 explicitly requires reports of the tests carried out to verify conformity with Annex I as part of the technical documentation, and the market surveillance authority can request them. Violations of Annex I or of Articles 13 and 14 carry fines under Article 64 of up to 15 million euros or 2.5 percent of worldwide annual turnover.

BSI TR-03183: The German Concretisation

As long as harmonised European standards are missing, TR-03183 is the most concrete interpretation of the CRA duties, even though it creates no presumption of conformity. Its weight is growing because the draft German CRA implementation act (cabinet decision of April 2026) designates the BSI as market surveillance authority. The four parts:

• Part 1 (General Requirements), v1.0.0 of 31 July 2026: translates Annexes I, II and VII into assessable controls with test actions, including risk-based selection of measures and OSCAL format
• Part 2 (SBOM), v2.1.0: mandatory fields of the software bill of materials, mapped to CycloneDX and SPDX
• Part 3 (Vulnerability Reports), v1.0.0: handling of incoming vulnerability reports
• Part H, v1.1.0: conformity assessment under Module H via an ISMS based on ISO/IEC 27001

Part 1 is built as an assessment catalogue: with an impartial evaluator, a PASS/FAIL verdict per control and an assessment report aligned with the documentation duties of Article 31 CRA.

The Role of the Pentest

TR-03183-1 explicitly demands the attacker perspective in risk handling and names "penetration testers or other cybersecurity experts" verbatim for it. Access protection, data integrity and attack surface hardening from Annex I Part I cannot be demonstrated by scanners and code reviews alone; it takes a controlled attack on the real product. The pentest report is at the same time exactly the artefact Annex VII point 6 demands, and an external tester brings the evaluator independence required by the BSI by definition.

In practice this means: a full pentest of the shipping configuration before market placement, followed by risk-based retests across the support period, which under Article 13(8) is at least five years. Triggers are major releases, new interfaces or changed authentication, not the calendar. The scope follows the risk assessment and, for a connected device, includes firmware, update mechanism, cloud backend and companion app, since remote data processing solutions count as part of the product under Article 3. Every test ends with a retest as proof that findings have been closed.

Conclusion

The CRA does not mandate a pentest, but it demands documented, effective and regular security testing that is hard to prove without one. TR-03183 turns this duty into an assessable catalogue, and the BSI will enforce it as market surveillance authority. There is time until December 2027 to set up the testing programme; those who start shortly before the deadline will test under time pressure and without the chance to fix findings at the design level.