The CRA regulation is the core mandatory regulation of the EU for the cybersecurity of digital products, covering all products with digital elements, and smart elevators and IoT elevators are clearly included in the category of high-risk products. The core requirements of the regulation include: elevator manufacturers need to establish a full-life cycle cybersecurity management system for products, and disclose the product security vulnerability repair mechanism; mandating that the control system and remote operation and maintenance system of smart elevators meet the EU cybersecurity grading standards; products need to complete cybersecurity compliance assessment before listing, and continue to monitor security risks and release patches in a timely manner after listing. The regulation sets a transition period, the reporting obligation will be implemented from September 2026, and it will be fully mandatory in December 2027. Smart elevator products that do not meet the requirements will be prohibited from entering the EU market.