Dusseldorf – November 05, 2026 -- Only 25.8% of German industrial companies actively and consistently demand Cyber Resilience Act (CRA) compliance from their suppliers, according to the ONEKEY IoT & OT Cybersecurity Report 2026. A further 33.3% do so only partially, and 20.8% have not yet acted. The report is based on a survey of 200 industrial companies in Germany.
The CRA makes cybersecurity a condition of EU market access for connected hardware and software. Manufacturers must assess risks from supplied software, firmware and pre-products, not only from their own code.
Suppliers lag on CRA readiness, and manufacturers lack visibility
Only 17.5% of suppliers have consistently prepared for the CRA and deliver the required information. Another 44.2% address the requirements in part, and 13.3% are barely prepared. For 25.0% of suppliers, manufacturers do not know the state of CRA preparation.
ONEKEY CEO Jan Wendenburg said suppliers in Asia often regard the CRA as a purely European matter. He called this a mistake: every supplier selling products or components in Europe must meet the rules itself. A manufacturer that builds foreign components into a product sold in Europe must also prove CRA conformity for the finished product.
Missing SBOMs and unclear versions become market-access risks
Wendenburg warned that missing software bills of materials (SBOMs), unclear software versions and unregulated security updates can directly become compliance and market-access risks. Supplier attestations and contractual assurances do not replace the manufacturer's own risk assessment, he said. The same applies to open-source components, where manufacturers must know the version used and any known vulnerabilities. Unmaintained libraries with no contact person or updates are especially problematic.
Multi-tier dependencies compound the exposure. A directly integrated library can contain further components unknown to the manufacturer, so one vulnerability can affect numerous products and product versions across several supply tiers.
A one-off SBOM does not satisfy the CRA
An SBOM must match the software actually shipped, be tied to a specific product version and be updated after relevant changes. Suppliers often deliver SBOMs in different formats, with inconsistent naming or without clear version data. Some lists cover only direct components, and others include parts used in development that are absent from the delivered product. Manufacturers must therefore merge, verify and compare supplier data against the actual binary or firmware state.
Vulnerability Exploitability eXchange (VEX) information can document whether and why a known vulnerability affects a specific product, which helps prioritize warnings and fixes. Wendenburg said compliance begins only when SBOM data feeds operational processes: assessing new vulnerabilities, identifying affected products, documenting decisions and delivering security updates on time.
Procurement contracts are shifting toward security data
Manufacturers will need reliable security information alongside technical specifications, prices and delivery dates. The report recommends agreements on machine-readable SBOMs, vulnerability reporting channels, response times, security updates and support periods. It also recommends passing on information from upstream supply tiers and regulating cases where a component is no longer maintained or a supplier ceases business.
ONEKEY's Product Cybersecurity & Compliance Platform identifies software components in binary and firmware files, imports and validates existing SBOMs, and supports the CycloneDX and SPDX formats plus VEX and VDR information. It monitors product versions continuously for known and previously unknown vulnerabilities, and automated impact assessments separate theoretical matches from relevant risks.