How Celadon helps OEMs plan for security, firmware support, and production requirements
If your company sells electronic products into the European Union, the Cyber Resilience Act (CRA) deserves attention—even if your product is a relatively simple handheld remote control. The key question is not just whether the remote connects to the internet. It is how the complete product communicates, how its software is managed, and who is responsible for placing it on the EU market.
The European Commission’s implementation timeline identifies September 11, 2026 as the start of certain manufacturer reporting obligations, with the CRA’s main requirements applying from December 11, 2027. For OEMs developing new products today, that makes early planning worthwhile.
At Celadon, we develop custom remote controls, receivers, and PCBs around each customer’s requirements. Our PCB development process covers component selection, circuit design, and customer-approved programming. That gives us an opportunity to discuss security-related design decisions before the hardware and firmware are finalized.
Start with the complete product—not just the remote
A basic infrared transmitter, a Bluetooth handheld, and an RF receiver connected to a computer can have very different security considerations. The CRA summary describes a broad scope for products with digital elements, including certain hardware and software with direct or indirect data connections. Applicability depends on the actual product and its intended use, not simply the label on the enclosure.
We recommend that OEM customers identify the handheld, receiver, host equipment, software, programming connections, and any service interfaces at the start of development. We can then evaluate the design options alongside the customer’s functional requirements and the conclusions of their compliance team.
Build the right controls into the design
For custom remote control systems, security starts with understanding what commands a product can send and what the receiving device is allowed to do. A volume command, for example, presents different concerns from a command that changes equipment settings or opens a maintenance mode.
Celadon offers custom protocol and addressability options for remote control applications. But addressing a receiver is not the same as authenticating a command, and a proprietary protocol is not automatically secure. Where a project requires authentication, replay protection, restricted maintenance access, or other controls, those requirements need to be specified, designed, and tested.
Plan firmware support before production
One of the most important conversations is how a product will be supported after shipment. Factory programming does not necessarily mean a remote can be updated in the field. Our discussion of programmable remote controls explains why it pays to think about future changes early.
Depending on the product, an update strategy can influence microcontroller selection, available memory, programming interfaces, firmware authorization, and recovery procedures. Some products may require a service-based correction or replacement instead of a field update. The appropriate approach should be established with the OEM before the design is approved.
The European Commission’s July 2026 implementation guidance provides additional information about support periods, risk assessments, and related obligations. These requirements should be reviewed with the customer’s compliance advisers and translated into realistic product specifications.
Keep production and firmware records useful
For an OEM, knowing which firmware version was approved is only part of the story. It can also be important to identify which hardware revisions, programming configurations, and production batches received that release.
Celadon’s development and manufacturing process includes programming to approved customer specifications, sample testing, and production approval. For projects that require additional traceability, we can work with the customer to define what release identifiers, records, and documentation should be maintained. Long-term monitoring, vulnerability response, and software maintenance should be agreed as specific project responsibilities rather than assumed manufacturing services.
Understand the reporting obligations
Under the CRA reporting guidance, manufacturers of covered products have obligations for certain actively exploited vulnerabilities and severe security incidents. The guidance describes a 24-hour early warning and a 72-hour notification, with additional final-report deadlines depending on the event.
The responsible manufacturer should establish its own reporting process and determine which products and events are covered. ENISA Single Reporting Platform resources provide information on registration and notification. Importantly, the reporting provisions can also affect relevant products already placed on the EU market before the December 2027 main application date.
Where Celadon fits in
Our role is to help OEM customers turn their product requirements into practical hardware, firmware, and manufacturing decisions. That can include reviewing communication interfaces, selecting appropriate components, defining programming and revision controls, and coordinating engineering changes during development.
The OEM and its qualified compliance advisers remain responsible for determining CRA applicability, legal obligations, and the appropriate conformity assessment route for the finished product. Celadon’s engineering services should not be confused with a CRA certification service.
If you are developing a custom remote control or receiver for the European market, contact Celadon early in the design process. We can discuss your application, the functionality you need today, and the support considerations that may influence the final product.
