New Industry Paper Supports TBS and BACS Manufacturers in Preparing for the Cyber Resilience Act
07/07/2026
EVIA is pleased to announce the publication of a new cross-industry paper, “Obligations and Opportunities for Technical Building Systems and Building Automation and Control Systems Manufacturers under the Cyber Resilience Act.” Developed together with leading European industry associations, the paper provides practical, non-binding guidance to help manufacturers understand and prepare for the implementation of the EU Cyber Resilience Act (CRA).
The Cyber Resilience Act introduces lifecycle-based cybersecurity requirements for products with digital elements, making cybersecurity an integral part of product design, development, maintenance and support. For Technical Building Systems (TBS) and Building Automation and Control Systems (BACS), this represents an important step towards more resilient, secure and trustworthy buildings.
Rather than viewing compliance as a regulatory burden, the paper highlights the opportunities the CRA creates for the sector, including:
- strengthening security-by-design and secure-by-default product development;
- improving product quality and lifecycle management;
- increasing transparency throughout the supply chain;
- supporting secure interoperability across multi-vendor environments; and
- building greater confidence in connected building technologies.
The publication also outlines practical recommendations for manufacturers, covering vulnerability handling, secure update strategies, lifecycle support, risk-based security approaches and preparation for upcoming reporting obligations under the CRA. It recognises the unique characteristics of technical building systems, including long product lifecycles, resource-constrained devices and the need to balance cybersecurity with operational continuity.
Developed collaboratively by EVIA together with ARGE, EHPA, eu.bac, EDSF, EPEE, EnOcean Alliance, Eurovent, European Ventilation Hygiene Association (EVHA), smartEn and VDMA Building Automation and Controls, the paper reflects a shared industry commitment to supporting manufacturers as they prepare for the new regulatory framework.
As cybersecurity becomes an increasingly important component of building performance and resilience, collaboration between manufacturers, policymakers and standards organisations will be essential to ensure a smooth transition and support innovation across Europe’s built environment.
The industry paper is available for download here: https://doi.org/10.5281/zenodo.20506150