The Trusted Connectivity Alliance (TCA) is pressing the European Union to give SIM and eSIM hardware a workable route through the Cyber Resilience Act (CRA). Its members, who make the secure chips inside phones and travel eSIM devices, say the current implementation timeline offers no clear compliance path. The outcome shapes how eSIM hardware reaches European devices.

The TCA said on 28 September 2026 that it welcomes a new Eurosmart position paper on scaling CRA conformity assessment.

What the TCA is asking for

The TCA fully supports the CRA's objectives, according to its statement. Its members still report significant concerns about the lack of a clear and reliable conformity assessment pathway for telecommunications products such as SIM and eSIM within the current implementation timeline.

Eurosmart's paper, titled "CRA Full Quality Assurance – Leveraging ISO 9001 for Module H Conformity Assessment", proposes one answer. It explores Full Quality Assurance (Module H) as a conformity assessment route. It argues that existing ISO 9001-based Quality Assurance Systems (QAS) can serve as the foundation for adding CRA-specific cybersecurity requirements.

The TCA calls this one potential route to practical and timely compliance. In its view, the approach reduces duplication and makes efficient use of Notified Bodies' capacity while keeping the required level of cybersecurity assurance.

Why SIM makers want existing schemes recognised

The TCA is also watching CRA standardisation work. It wants that work to recognise or build on established security assurance frameworks, including the GSMA's eSA (eUICC Security Assurance) and SAS-UP (Security Accreditation Scheme for UICC Production). The TCA says these have supported telecommunications security for many years.

Its earlier 11 May 2026 position lays out the reasoning. The public consultation on several draft standards, including prEN 18330, prEN 40000 and prEN 50764, closed in April 2026. The TCA describes the European Commission's roadmap as leading to full CRA applicability by the end of 2027.

Three sticking points for eSIM hardware

The TCA's CRA Working Group reviewed the drafts and raised three issues in that May statement:

  1. Duplicate certification. The TCA wants CRA compliance to reuse established global certification frameworks. It says extra EU-specific conformity assessment would add cost, delay and complexity, and would put European manufacturers at a competitive disadvantage in non-EU markets.
  2. Component status. The TCA says a UICC (Universal Integrated Circuit Card) or eUICC (embedded UICC, the chip behind an eSIM) is a component built into end products and not sold directly to end users. In its view, the CRA essential requirements do not always apply to such parts.
  3. Security updates. CRA Annex I requires manufacturers to provide security updates over a product's lifespan. The TCA says UICCs have only very limited remote software update capability, so the requirement is unworkable for them.

The TCA asks whether a product that cannot meet a requirement is non-compliant or simply exempt. If non-compliant, it warns of significant market disruption affecting hundreds of millions of classic UICCs in use throughout Europe.

What this means for travelers

Nothing changes for your next trip. The CRA applies in full by the end of 2027, according to the TCA's description of the Commission roadmap, and this debate concerns the chips, not the eSIM plans you buy. It still matters, because the rules decide how smoothly secure eSIM hardware reaches European phones and travel devices.

Choose a provider that sells plans for the eSIM-capable device you already own, and compare coverage and price first. Use the eSIMzee provider comparison to do it.

Sources