Silicon Motion Technology has completed the first stage of its compliance program for the European Union’s Cyber Resilience Act (CRA), strengthening its cybersecurity processes ahead of new incident-reporting requirements that take effect on September 11, 2026.
The company, a supplier of NAND flash controllers for solid-state storage devices, said it has aligned its cybersecurity controls and internal processes with the CRA’s initial requirements. It has also established vulnerability-handling procedures as part of its broader preparation for the regulation’s full application on December 11, 2027.
The EU CRA introduces cybersecurity requirements for products with digital elements, placing greater emphasis on security throughout the product lifecycle. For semiconductor and component suppliers, this increasingly extends cybersecurity responsibilities beyond product development to post-market vulnerability management, incident handling and coordinated disclosure.
What’s the biggest challenge you face when working with Embedded Systems?
Silicon Motion said its initial program focuses on several areas, including security due diligence for third-party hardware and software components, continuous vulnerability monitoring and remediation, coordinated vulnerability disclosure, and incident escalation and reporting procedures.
The company has also established a dedicated security vulnerability reporting channel, allowing customers, end users and other stakeholders to report suspected security issues for investigation and response.
“These measures span Silicon Motion’s full product portfolio,” the company said, covering enterprise and edge SSD controllers, enterprise boot-drive solutions, embedded eMMC and UFS controllers, Ferri solutions for automotive and Physical AI applications, and display interface products.
“As AI expands across data centers, edge devices and Physical AI applications, cybersecurity has become an essential part of product development,” said Wallace C. Kou, president and CEO of Silicon Motion. “This initial CRA compliance milestone demonstrates our strong commitment to product security and our determination to deliver secure products that serve as a trusted foundation for customers to build resilient storage solutions.”
Silicon Motion emphasized that the milestone represents a preparatory step rather than the completion of its CRA program. The company plans to continue refining its processes as implementing guidance and harmonized standards for the regulation are developed.
The announcement reflects a broader shift for semiconductor suppliers, where cybersecurity is becoming an increasingly important consideration alongside performance, power efficiency and reliability. As connected storage and AI systems proliferate, component vendors will face growing pressure to demonstrate that security and vulnerability response are embedded throughout the product lifecycle.
