Cyber Resilience Act (CRA)
Cybersecurity throughout the product lifecycle. At Joifilabs, we approach CRA requirements by coordinating our software and integration work with the manufacturers and suppliers of the hardware used in each project.
A European framework for digital products
Regulation (EU) 2024/2847 establishes cybersecurity requirements for products with digital elements placed on the EU market within its scope. It covers security by design, risk assessment, vulnerability handling, security updates and evidence of conformity. Applicability must be assessed for each product and the role of each economic operator.
- 11 September 2026
- The reporting obligations for actively exploited vulnerabilities and severe incidents affecting product security apply from this date.
- 11 December 2027
- The main CRA requirements apply from this date, subject to the regulation’s scope and transitional provisions.
Third-party hardware, clearly defined responsibilities
Joifilabs does not manufacture the third-party hardware used in our solutions. We develop software and integrate equipment from specialised partners. Hardware conformity must be assessed with the manufacturer and supplier of the specific equipment.
Hardware manufacturer and supplier
We coordinate with the relevant provider to obtain applicable conformity evidence, security documentation, firmware and BIOS information, support periods, vulnerability contacts and available security updates for each model and version.
Joifilabs: software and integration
Our work focuses on the software we develop, system configuration and integration risks, and coordination of vulnerabilities and corrections with the hardware provider. The applicable responsibilities and support arrangements must be established for each project.
Using third-party hardware does not remove our own obligations. If a final product is placed on the market under our name or trademark, or a substantial modification is made, manufacturer obligations may apply. Component conformity alone does not demonstrate conformity of the complete system.
Hardware partners
Congatec, Engicam and Qiyangtech are our hardware partners. Their platforms support our solutions, and their collaboration is necessary to meet applicable CRA requirements for the hardware and to support our software and system integration work.
Congatec
Hardware partner for our solutions
Engicam
Hardware partner for our solutions
Geniatech
Hardware partner for our solutions
Qiyangtech
Hardware partner for our solutions
We require applicable CRA conformity evidence and coordination on documentation, vulnerabilities, updates and support. This page does not certify that every product from these partners is CRA compliant: the status must be verified for each model, version and supply.
Standards we follow
We are not a partner of the organisations below. We develop our systems in line with these sector standards.
- Applied in our developments
Our developments follow the VDV301 standard for passenger information systems in local public transport.
- Coming soon
We are preparing our developments to align with ITxPT S04 (Chestnut).
Following a standard does not imply membership, partnership or certification by the organisation that issues it.
Purchased equipment: coordination with its provider
For every purchased device, CRA compliance will be coordinated with the supplier of that device. This includes equipment from Belden, Hella, Advantech, Radwin, Zenitel and any other provider involved in the project. We do not present third-party equipment as hardware manufactured by Joifilabs.
Belden
Hella
Advantech
Radwin
Zenitel
Assessment is specific to the equipment, its intended use, version and support period; listing a provider is not a declaration of CRA conformity.
Coordination for each project
01 · Identify and document
Identify the hardware, firmware and software versions, intended use and applicable roles. Request conformity evidence and component inventories (SBOM), where relevant, from each provider.
02 · Assess the integration
Review interfaces, configuration, access controls and system risks. Define responsibilities, support periods and update arrangements with the customer and providers.
03 · Coordinate the response
Analyse reported vulnerabilities, involve the affected provider and coordinate corrections, deployment and customer communications. Statutory reporting remains the responsibility of the obligated party.
Report an issue affecting your system
Our cybersecurity reporting channel collects details of the affected equipment and software. Include the manufacturer, model and version so we can assess the issue and coordinate with the relevant provider.
Report a vulnerabilityReference sources
This page describes our approach to CRA coordination, not a certification or a general declaration of conformity. The applicable requirements and conformity evidence must be validated for each product and project.