Only 25.8% of German Industrials Demand CRA Compliance From Suppliers
Dusseldorf – November 05, 2026 -- Only 25.8% of German industrial companies actively and consistently demand Cyber Resilience Act (CRA) compliance from their suppliers, according to the ONEKEY IoT & OT Cybersecurity Report 2026. A further 33.3% do so only partially, and 20.8% have not yet acted. The report is based on a survey of 200 industrial companies in Germany.
The CRA makes cybersecurity a condition of EU market access for connected hardware and software. Manufacturers must assess risks from supplied software, firmware and pre-products, not only from their own code.
Suppliers lag on CRA readiness, and manufacturers lack visibility
Only 17.5% of suppliers have consistently prepared for the CRA and deliver the required information. Another 44.2% address the requirements in part, and 13.3% are barely prepared. For 25.0% of suppliers, manufacturers do not know the state of CRA preparation.