Cyber Resilience Act conformity notice

Koja Group’s conformity notice concerning Regulation (EU) 2024/2847 of the European Parliament and of the Council (Cyber Resilience Act)

Conformity with the requirements in force on 11 September 2026:

In its role as a manufacturer, Koja Group has implemented the practices and assigned the responsible roles required by the CRA’s reporting obligations. In addition to the parent company Koja-Yhtiöt Oy, Koja Group comprises Koja Oy and Chiller Oy, together with their subsidiaries and operations.

We are actively working with all our suppliers to bring the cybersecurity of equipment into line with the CRA’s technical requirements where the equipment is not already compliant. Before the technical requirements become applicable on 11 December 2027, we will carry out software updates and, where necessary, instruct our customers to update their equipment. We continuously cooperate with suppliers of digital elements to ensure that our equipment complies with the laws and directives in force at any given time.

Conformity with the reporting obligations from 11 September 2026 on:

  • Reports from suppliers and customers concerning serious cybersecurity incidents and actively exploited vulnerabilities under the CRA are received at cra-chiller@chiller.fi and cra-koja@koja.fi. The CRA responsibility teams respond to incoming reports and initiate the appropriate cybersecurity procedures.
  • The CRA responsibility teams monitor and respond to suppliers’ public notifications concerning the digital elements used in our equipment, namely components, software, and services.
  • The CRA teams organise the investigation, and the designated representatives submit the required notifications to the Finnish CSIRT and ENISA through the Single Reporting Platform (SRP).
  • The CRA teams publish information on our websites if an identified vulnerability is being actively exploited or if the equipment is affected by a serious cybersecurity incident as defined in the Regulation.
  • The notifications are updated with information on corrective measures or mitigating measures that users can take.