Translations:Cyber Resilience Act (CRA)/73/en

• Both Article 32 GDPR and Article 13 CRA follow a risk-based approach. The measures to be taken should be appropriate to the risk and consider various factors. Annex I(1) CRA requires an adequate level of security. This also applies to Article 32 GDPR, which, unlike Annex I(1) CRA, explicitly mentions that implementation costs must also be considered.