Quectel Modules Demonstrate Compliance Readiness for EU Cyber Resilience Act

NUREMBERG, Germany – March 9, 2026 – Quectel Wireless Solutions, a global provider of end-to-end IoT solutions, has reaffirmed its commitment to meeting the requirements of the European Union’s Cyber Resilience Act (CRA) ahead of the September 11, 2026, deadline. The company’s cybersecurity program for its module portfolio is designed to ensure compliance, offering customers a pathway to meet the CRA’s mandatory security standards.

Meeting the CRA’s Key Requirements

Quectel’s approach focuses on several key areas mandated by the CRA, including security by design, the availability of Software Bills of Materials (SBOMs), vulnerability disclosure and incident reporting. This proactive stance reinforces Quectel’s dedication to delivering secure and future-ready IoT solutions for both European and global markets.

Strategic Partnership with Finite State

To bolster its security posture, Quectel has collaborated closely with Finite State, a leading firm specializing in connected device and software supply chain security. This partnership ensures that Quectel’s product portfolio aligns with the CRA and other international industry standards. The collaboration emphasizes transparency, regulatory alignment, and maintaining industry-leading cybersecurity standards.

“For over four years, Finite State has been Quectel’s third-party cybersecurity partner, underscoring our commitment to ensuring the security of our modules,” said Willis Yang, Senior Vice President of Quectel Wireless Solutions. “Compliance and security are essential elements of our approach to product design. Being able to count on Finite State to test and verify the safety of our products is also essential to guarantee our customers high-end and perfectly secure products.”

Benefits for Quectel Customers

Quectel’s cybersecurity approach, combined with its partnership with Finite State, provides customers with confidence in the security and compliance of their products. Quectel’s IoT modules are delivered pre-tested and audit-ready, supported by comprehensive security documentation, including SBOMs, VEX files, and detailed vulnerability reports.

Matt Wyckhouse, CEO of Finite State, stated, “Our partnership with Quectel demonstrates a clear and concrete commitment to supporting regulatory-compliant cybersecurity. The integration of continuous security testing throughout the product cycle and the guarantee of total transparency thanks to software nomenclatures, has allowed Quectel to be a leader in the module sector in terms of cybersecurity for more than four years. This rigorous, standards-based approach allows customers to meet mandatory security and reporting obligations with greater confidence and reduced risk.”

The EU Cyber Resilience Act: A Deeper Glance

The CRA mandates that manufacturers ensure the security of their devices throughout their lifecycle, including providing regular updates and effective vulnerability management. Demonstrating compliance requires comprehensive technical documentation and verifiable evidence to satisfy regulatory control and market surveillance requirements.

Quectel’s Three-Pillar Security Approach

Quectel’s security strategy is built on three core pillars:

• Rigorous, Independent Security Testing: Going beyond internal validation to provide externally verifiable assurance.
• Complete Software Supply Chain Visibility: Providing full transparency on each software component integrated into its modules to meet customer compliance and audit requirements.
• Comprehensive Risk Management: Based on continuous monitoring and structured resolution processes designed to adapt to an increasingly complex regulatory environment and evolving cybersecurity threats.

About Quectel

Quectel Wireless Solutions is a global end-to-end IoT solutions provider with over 5,800 employees worldwide. The company offers a wide range of modules, including cellular, GNSS, satellite, Wi-Fi, and Bluetooth, as well as antennas, value-added services, and ODM/systems integration. Learn more at www.quectel.com or on LinkedIn.

About Finite State

Finite State provides a product security automation platform for connected devices, helping manufacturers secure every release and ensure ongoing compliance by integrating firmware, source code, and vendor data into a single, verifiable system. Learn more at www.finitestate.io.