From a cybersecurity historian perspective, modern digital networked devices and services emerged largely in the early 1960s through a combination of developments at AT&T (Bell Labs), RAND Corporation (Baran & Boehm), and UK National Physical Laboratory (Davies). The integration of these products digitally resulted in NSA (Peters) and RAND (Ware) collaboration for a year on resulting vulnerabilities and mitigations that were publicized at the 1967 AFIPS conference. Their work was further developed by a task force whose recommendations were vetted in1970 by the Defense Science Board. The basic cybersecurity limitations and remediation challenges have not changed during the ensuing half century.

The next fifty years gave rise to numerous initiatives and techniques undertaken by innumerable government agencies, companies, and institutions worldwide that attempted to overcome the persistent cybersecurity challenges without understanding the limitations. Some worked; most failed. Cybersecurity history is littered with countless notable births and deaths of cybersecurity undertakings that failed to know their limitations. The phrase “a man has got to know his limitations” is a famous sage admonition from a Hollywood film series that applies equally well to institutions.

One of the current prominent initiatives on the historical cybersecurity timeline began as a strategy in 2020 via European Union legislation to create an enormously complex new regime known as the Cyber Resilience Act (CRA). Although well-intended, it historically represents the concatenation of multiple inherent limitation excesses and failed techniques now exacerbated by recent tectonic impacts from new foundational AI.

CRA regime known limitation excesses and failed techniques

There are many significant contemporary initiatives today directed toward improving the security of Information and Communications Technology (ICT) products and services worldwide. By almost any metric, however, the CRA ranks by far as the most expansive on the historical timeline. It is also the only one attempted on a global scale for every networked digital product in existence using legislative and regulatory enactments with extensive enforcement and substantial penalties.

The CRA regime came into force as European law in December 2024, and its various obligations begin in stages starting this year. Significant monetary and human resources have been dedicated to subsidiary activities such as contracted standards-making venues where consultants were hired to pursue attempted development of thousands of normative technical and operational specification provisions. Toiling over the past two years in a set of small European Commission-designated groups and consuming thousands of almost abstruse input contributions, the activities have been repeatedly delayed, contentious, and subject to challenges. Meanwhile, new foundational AI developments have fundamentally altered the nature and dynamics of actions required to achieve CRA objectives. Overarching all of the CRA regime are four well-known institutional limitation excesses.

1. Legislating detailed requirements

The general practice in governmental legislative activities for highly technical and dynamic domains is to avoid instantiation of detailed requirements or state-of-the-art dependencies in the resulting provisions. This practice is especially significant in a domain like cybersecurity design where the changes at multiple levels occur daily. The CRA legislation, however, became a grab-bag of scores of schemes and detailed requirements expressed in a fifty-three thousand-word enactment in 2024 with 54 pages of substantive provisions. Especially prominent was the grounding on an almost incomprehensible scheme of conformance certifications. Certification approaches for digital products have shown themselves to be less than useful over the past five decades of cybersecurity initiatives. They principally benefit a hidden certification-industrial-complex including paywall standards vendors, divert resources from user implementation of necessary controls, and are unable to deal with rapidly changing technologies, product offerings, and practices.

2. Excessive exercise of subject matter and legal jurisdiction

The CRA regime was cast to apply to all “products with digital elements “that enter the European market, including remote processes. It imposes hundreds of related continuing registration, product design, reporting and notification obligations on all entities associated with those digital elements anywhere in the world, with severe penalties for non-compliance. The expansiveness of CRA subject matter and legal jurisdiction is unparalleled and far exceeds any others in existence. Imposing and maintaining any kind of regulatory regime on such a grand amorphous slice of the universe is simply not feasible.

The imposition of the CRA regime is also largely an exercise of extraterritorial jurisdiction because the preponderance of the obligated entities exist outside the European Union. Obtaining the necessary cooperation of other national jurisdictions to implement the CRA regime is highly unlikely, and enforcement threats in the Internet world are inherently hollow.

3. Inability to implement and enforce the legislative norms

Implementation of the CRA regime has multiple critical dependencies. Foremost are an initial set of 41 technical standards deliverables outsourced to two designated standards organisations. One of them (CEN/CENELEC) has an almost complete further dependency on an additional organisation (ISO/IEC) and limited cybersecurity subject matter expertise that today is spread across innumerable other specialised industry bodies. Exacerbating these limitations further is the reality that the standards deliverables and enforcement scheme must pass judicial muster and be continuously maintained and evolved forever.

Additional significant dependencies exist in establishing and maintaining the extraordinarily complex sets of bodies necessary for administrative maintenance of the enormous amounts of information created under the CRA regime, for subsequent investigations and enforcement, and for analysis and coordination tasks. Further complications and critical dependencies are the interplay with all the other major EU cybersecurity related enactments, especially NIS2 and the AI Act. All of them have some similar and overlying regime requirements.

4. Abridgement of legal norms and human rights

Like most contemporary governmental jurisdictions, the excesses of legislative and executive branches are constrained by a judicial branch that has final authority. The treaty instrument which created the European Union has multiple safeguards as well as expressions of fundamental rights. The European Court of Justice (ECJ), at the top of the EU hierarchy, has repeatedly demonstrated a willingness to review the excesses and omissions of the other EU government branches.

The fundamental EU treaty requirements of proportionality and reasonableness are especially applicable to the CRA regime and its Achilles Heel. The excessive exercise of subject matter and legal jurisdiction over an entire digital universe of products and parties that is essentially incomprehensible, vicarious, and discriminatory provides ample bases for striking down major components of the regime. The juridical liability is exacerbated by lack of any cost-benefit analysis, much less supportability for the thousands of requirements being imposed. The recent introduction of foundational AI cybersecurity techniques significantly alters the efficacy of many of the CRA regime requirements being imposed—notably those relating to certification and vulnerability handling.

In 2024, near the time of CRA adoption, the ECJ handed down a fundamental European Human Rights Judgment against the EC requiring transparency in normative standards development processes, especially including the public availability without paywalls of technical standards incorporated by reference. The judgment resulted in an ensuing struggle to implement the transparency provisions—exacerbated by the practice of one of the contracted standards body pairs to exclusively use nested ensembles of paywall standards and bind them to CRA provisions. The lack of transparency has impaired both the standards development processes as well as any cost-benefit consideration of the requirements imposed.

Additional ancillary human rights at issue under the CRA regime include implied rights of users to choose their own digital products and of providers of software to express themselves through computer code. They are both relevant within the European Software Freedom movement. As a practical matter, considering the ubiquitous autonomous porosity of digital network infrastructure, the enforcement of the CRA regime would require untenable police powers.

The challenge of regime extrication

Institutions—particularly prominent political ones—face special challenges in extricating themselves from errant pursuits. The attributes of institutional stature, individual resume building, funding and employment tend to be counterweights to change no matter how compelling.

The CRA emerged six years ago as a political expression of collective frustration over the continuing growth of cyber threats and an attempt to shift economic costs of cyber threats to product manufacturers. The shift of many of those costs is not entirely fair because cyber threats partly arise from the wrongful conduct and omissions of end users over which manufacturers have little control. Several decades ago in the national security ecosystem, this duality was treated through the use of continuously evolving Configuration Guides emerged to effect necessary shared implementation requirements. The practices have been continued by multiple parties and baked into the ETSI Critical Security Controls.

For the CRA, however, the concatenation of so many fundamental limitation excesses, including significantly changed circumstances, arguably makes the task of regime change easier. These changes can emerge from within any of the multiple legislative, executive or judicial bodies of the EU. Additionally, because the CRA enforcement falls significantly on EU Member States, they can facilitate needed major changes in the current CRA regime. Everyone in the cybersecurity ecosystem should be motivated to develop a CRA2 that learns from cybersecurity history and is actually implementable, sustainable, and effective in today’s foundational AI world.

Toward a CRA2

Not unexpectedly, a CRA schemozzle is emerging. The current state of the CRA regime is patently not implementable, effective or sustainable. As to CRA regime enforcement, a previous generation of potential regulators thirty years ago in a much more controllable world, found out that by design “the net views regulation as damage and routes around it.” Digital elements and processes are not easily stopped or inspected at geopolitical borders.

Regulatory regimes do sometimes totally collapse, but more often they evolve. There are potential benefits to a significantly recast CRA—a CRA2 that more closely aligns with other governmental jurisdictions and institutions worldwide that is implementable and sustainable. CRA objectives are worth continuing with triage of what currently exists.

Reflecting on the updated exhaustive analysis of the CRA regime in 2025, several major changes seem essential for a viable CRA2 regime. Cybersecurity certification schemes, enforcement, and penalties for every digital element are simply not feasible, much less reasonable. They should be removed in their entirety and the massive, needed funds for the bureaucratic infrastructure necessary to support those activities redirected to the EC National Coordination Centres and tool development activities and support of NIS2. The thousands of normative provisions developed by the EC-funded consultants toiling in the designated standards committees should be reviewed and replaced with smaller sets of citations to existing applicable industry standards in a small number of applicable guidance documents that evolve with the cybersecurity state-of-the-art. Ideally, the relevant provisions under CRA2 should be continuously reviewed and evolved, open-network available, machine-readable, well-versioned, and produce demonstrable artifacts.

Especially important in a CRA2 regime is closer engagement with the EU’s own excellent cybersecurity user communities such as GCVE.EU and National Coordination Centres. Collaborating on the responsive measures following from the introduction of foundational AI is essential.

Other widely accepted and effective frameworks and implementation tools to achieve equivalent Secure by Design objectives are available. Prominent examples with mappings include the ETSI Secure Software Development and Implementation Framework (SSDIF) and the UK NCSC Cyber Resilience Testing (CRT) Assurance Principles and Claims (APC) introduced in ITU-T as Rec. X.crta. NIST has recently published a revised SSDF. Non-profit industry consortiums and foundations like SAFECode, LINUX Foundation, OWASP and GitHub continuously stream and update related open-source freely available standards, guides and tools.

The National Academies released a 2025 Consensus Study Report that includes AI effects. Such suitable alternative frameworks provide demonstrable presumption of conformity and an easy off ramp from CRA unimplementable excesses and the creation of CRA2 through cooperation and collaboration with the many communities addressing the same needs.