Nordic Semiconductor announces a significant step in preparing customers for the EU Cyber Resilience Act (CRA), with nRF Cloud now offering a one-time, upfront, lifetime FOTA (Firmware Over-the-Air) and device management license.
According to the CRA, manufacturers deploying connected devices on the European market must provide security updates for identified vulnerabilities throughout each device’s lifetime, starting in 2027. Available across Nordic’s low-power wireless portfolio, nRF Cloud enables developers to meet CRA secure update requirements in minutes instead of months, avoiding the complexity of building their own update infrastructure, and with a simple one-time cost.
“Preparing for compliance with the EU Cyber Resilience Act is going to add significant operational overhead and project complexity for device manufacturers,” explains François Baldassari, founder of Memfault and VP Software Services at Nordic Semiconductor. “With the enforcement of the CRA approaching quickly, Nordic is providing solutions that simplify and accelerate the compliance process for its customers.”
Pre-integrated on every Nordic-based device, nRF Cloud provides manufacturers a turnkey foundation for EU CRA and U.S. Cyber Trust Mark readiness. This is done by ensuring secure updates, auditability, and long-term support are straightforward and cost-predictable across the product lifecycle.
A complete solution from chip to cloud
nRF Cloud is integrated with Nordic’s unified and scalable software development kit – the nRF Connect SDK – and provides a proven chip-to-cloud FOTA solution deployed at scale.
Key capabilities include:
- MCUboot bootloader built into nRF Connect SDK
- Global FOTA delivery network optimised for low-power devices
- Ready-made FOTA libraries for gateway-based updates
- Automated staged rollouts with analytics, health monitoring, and rollback
- Intuitive fleet management console
- Approval workflows and immutable audit logs
Lifetime pricing that redefines FOTA economics
Traditional FOTA approaches require ongoing cloud fees or expensive custom infrastructure. The lifetime FOTA model from Nordic Semiconductor replaces this with a single upfront fee that covers secure updates and device management for the device’s entire lifespan. This ensures long-term maintainability and regulatory compliance.
“Lifetime FOTA turns long-term device support from a cost burden into a competitive advantage. Manufacturers can maintain device security, and ship features, fixes, and improvements to deployed devices without worrying about costs and complexity,” explains Baldassari. “Furthermore, by unifying silicon, software, and cloud, we make regulatory readiness practical on day one and sustainable for years, reducing total cost of ownership and accelerating time-to-market.”
A new offering built on Memfault’s trusted foundation
nRF Cloud’s FOTA model is built on infrastructure originally developed by Memfault, the IoT reliability and observability platform Nordic acquired in 2025. Customers benefit from a system that has been field‑tested across millions of devices and refined over years of development.
The integration of Memfault technology into nRF Cloud supports Nordic’s focus on reducing lifecycle maintenance effort and simplifying regulatory compliance through a combined hardware, software, and services offering. This unified stack enables customers to bring connected products to market more efficiently and maintain them over the long term.
There’s plenty of other editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by visiting our LinkedIn page.
