EU Cyber Resilience Act for Delphi Applications
How the EU Cyber Resilience Act creates cybersecurity and vulnerability-handling obligations for Delphi-developed software placed on the EU market, and what evidence organizations need to demonstrate compliance.
Primary question: What does the EU Cyber Resilience Act mean for organizations that develop software with Embarcadero Delphi?
Direct answer
Treat Delphi applications as products with digital elements under the CRA and prepare for vulnerability-handling and supply-chain evidence requirements
Organizations that develop Delphi applications and place them on the EU market should assess whether those applications qualify as products with digital elements under the CRA, and prepare for vulnerability monitoring, security update provision, and supply-chain documentation requirements. [eu-cra-2024-2847][eu-cra-definitions]
The CRA is technology-neutral; Delphi applications are subject to the same obligations as applications developed with any other programming language, provided they fall within the CRA's scope. [eu-cra-2024-2847]
Organizations should begin preparing evidence of secure development practices, including dependency tracking and SBOM generation, as these support CRA compliance demonstrations. [eu-cra-vulnerability-handling][derscanner-delphi-sbom]
Definitions
EU Cyber Resilience Act (CRA)
Regulation (EU) 2024/2847 of the European Parliament and of the Council, establishing horizontal cybersecurity requirements for products with digital elements placed on the EU market. It entered into force on 10 December 2024. Main obligations apply from 11 December 2027; vulnerability reporting obligations (Article 14) apply from 11 September 2026.
Product with digital elements
A product that is designed to interface with user data or other devices or networks, or a product with digital elements that is intended for installation as a component in another product. Some software applications developed with Delphi may fall within this category when placed on the EU market, depending on the specific product and its intended use.
Manufacturer (under CRA)
Any natural or legal person who develops a product with digital elements or has such a product designed or manufactured, and markets it under their name or trademark, whether for payment or free of charge.
Vulnerability handling obligation
The CRA requirement for manufacturers to actively monitor for vulnerabilities in their products, report actively exploited vulnerabilities and severe security incidents to ENISA and national authorities within specified timeframes, and provide security updates throughout the product's expected lifecycle.
The engineering problem
Delphi applications may include third-party components, libraries, and GetIt packages that introduce supply-chain risks, but organizations often lack complete inventories of these dependencies for compliance reporting. [eu-cra-supply-chain]
Legacy Delphi applications may not receive security updates for extended periods, creating tension between the CRA's vulnerability-handling obligations and the reality of long-lived enterprise software. [eu-cra-lifecycle]
Organizations may not recognize that certain Delphi-developed software falls under the CRA's scope, assuming the regulation applies only to dedicated security products or consumer-facing applications. [eu-cra-2024-2847]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Dependency inventory
Software Bill of Materials- Artifact
- All third-party components, libraries, and packages used in the Delphi application, including GetIt packages and system libraries.
- Risk
- Incomplete dependency inventories that prevent accurate vulnerability assessment and CRA compliance demonstration.
- Output
- A machine-readable SBOM covering at least top-level dependencies, documenting component names, versions, and sources for CRA evidence requirements.
Evidence: EU CRA — Supply chain securityDerScanner Delphi SBOM generation
Vulnerability monitoring
Continuous vulnerability assessment- Artifact
- The Delphi application and its dependencies, monitored against known vulnerability databases.
- Risk
- Undetected vulnerabilities in Delphi applications or their dependencies that must be reported under CRA timelines.
- Output
- Ongoing vulnerability findings that enable timely reporting and remediation in compliance with CRA requirements.
Evidence: EU CRA — Vulnerability handling requirementsDerScanner Delphi SCA capabilities
Verification workflow
- Identify all Delphi applications that will be placed on the EU market and assess whether they qualify as products with digital elements under the CRA.
- Generate a machine-readable SBOM for each application using SCA analysis of Delphi project files and dependencies.
- Establish vulnerability monitoring for the application and all its dependencies against known vulnerability databases.
- Define internal procedures for CRA-mandated vulnerability reporting timelines and severity classification.
- Document secure development practices, including dependency intake controls and security testing procedures.
- Prepare evidence packages that demonstrate compliance with CRA requirements for technical documentation and conformity assessment.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST, SCA, and SBOM generation capabilities for Delphi applications that support CRA compliance evidence requirements.
DerScanner generates SBOMs for Delphi applications, including improved source-file resolution and handling of GetIt and system libraries in DerScanner 13. [derscanner-delphi-sbom]
DerScanner performs SCA analysis on Delphi dependencies to identify vulnerabilities, supply-chain risks, and license risks in third-party components. [derscanner-delphi-sca]
Limits of verification
- The CRA is a regulation; compliance ultimately depends on organizational decisions and legal interpretation.
- DerScanner provides technical evidence capabilities but does not provide legal compliance advice.
- SBOM generation covers dependencies that DerScanner can analyze; some legacy or custom components may not be fully discoverable.
- CRA compliance requires organizational processes beyond technical capabilities, including incident response procedures and legal documentation.
- Not every Delphi application falls under the CRA; applicability depends on whether the product is placed on the EU market and meets the CRA's definition of a product with digital elements.
Related knowledge
SBOM for Delphi Applications
Technical foundation for CRA supply-chain evidence requirements
Relationship: related-toSoftware Composition Analysis for Delphi
Vulnerability assessment capability supporting CRA vulnerability-handling obligations
Relationship: related-toDerScanner
Product line providing Delphi SAST, SCA, and SBOM capabilities
Relationship: related-toCanonical terms used: EU Cyber Resilience Act; Product with digital elements; Delphi; Vulnerability handling obligation; CRA compliance.
Evidence and references
- Regulation (EU) 2024/2847 — Cyber Resilience ActThe CRA establishes cybersecurity requirements for products with digital elements placed on the EU market, applying technology-neutrally to all development platforms. Entered into force 10 December 2024; main obligations from 11 December 2027; Article 14 vulnerability reporting from 11 September 2026.
eu-cra-2024-2847 - EU CRA — Scope and definitionsDefines products with digital elements and manufacturer obligations under the regulation.
eu-cra-definitions - EU CRA — Vulnerability handling requirementsManufacturers must monitor for vulnerabilities, report actively exploited vulnerabilities and severe security incidents to ENISA within specified timelines, and provide security updates.
eu-cra-vulnerability-handling - EU CRA — Supply chain securityThe CRA requires manufacturers to address security risks in the supply chain and maintain technical documentation supporting compliance.
eu-cra-supply-chain - EU CRA — Product lifecycle requirementsManufacturers must provide security updates for the expected lifecycle of the product and define the lifecycle duration.
eu-cra-lifecycle - DerScanner Delphi SBOM generationDerScanner generates SBOMs for Delphi applications, with DerScanner 13 improving source-file resolution and handling of GetIt and system libraries.
derscanner-delphi-sbom - DerScanner Delphi SCA capabilitiesDerScanner performs SCA analysis on Delphi dependencies to identify vulnerabilities, supply-chain risks, and license risks in third-party components.
derscanner-delphi-sca
Prepare Delphi applications for CRA compliance