Embedded-device manufacturers facing the European Union’s Cyber Resilience Act requirements may be able to add TPM 2.0 capabilities without reworking their hardware. Variscite and SecEdge have made a firmware-based implementation available across Variscite’s i.MX system-on-module portfolio, targeting both new devices and qualifying systems already in the field.
The companies said the integration adds SecEdge’s SEC-TPM firmware TPM implementation to Variscite modules based on NXP i.MX processors. The approach uses the processor already included in a device design rather than requiring a separate Trusted Platform Module chip or a board respin.
TPM 2.0 provides a protected environment for secure boot, device identity, and the storage and use of cryptographic keys. It can be delivered through a discrete security chip or through firmware on an application processor. SecEdge’s implementation operates in the OP-TEE secure world through Arm TrustZone and is designed to meet Trusted Computing Group TPM 2.0 specifications.
On i.MX 93 and i.MX 95 modules, the firmware can use NXP’s EdgeLock Secure Enclave as a hardware root of trust. That architecture matters for manufacturers building connected industrial, medical, retail, transportation, and other edge devices that must establish device identity and protect cryptographic material throughout a long deployment life.
The partnership arrives as manufacturers prepare for the European Union’s Cyber Resilience Act. The companies said reporting obligations for actively exploited vulnerabilities and severe incidents began Sept. 11, 2026, with broader requirements scheduled to take effect Dec. 11, 2027. Under the timetable cited by the companies, manufacturers must report actively exploited vulnerabilities and severe incidents within 24 hours, then provide a full notification within 72 hours. The broader requirements include secure default configurations, protection against known exploitable vulnerabilities, security updates during a support period, and conformity assessment before CE marking.
The TPM function is not, by itself, a compliance program. The companies position it as a standards-based way for a device to prove what it is and protect the cryptographic keys it holds, two elements they identify as important for meeting the Act’s requirements. Manufacturers would still need to manage product configuration, vulnerability handling, update support, and the conformity work required for their products.
For OEMs and systems integrators, the immediate practical benefit is a potential path to add TPM 2.0 functionality to supported deployed products without changing the circuit board. Systems must support secure firmware updates, but the model could help engineering teams extend a security architecture to existing platforms as well as future designs.
Variscite said it will support the transition through maintained board-support-package branches that carry kernel and package security updates, along with secure-boot and TPM integration documentation. The company’s stated product-longevity target of seven to 15 years also exceeds the CRA’s default five-year support period cited by the companies.
SEC-TPM is now integrated and available through Variscite’s Developer Center for its i.MX 6, i.MX 7, i.MX 8, and i.MX 9 system-on-module families. Within Variscite’s pin-compatible product families, customers can also move to higher-performance modules without redesigning the security architecture, according to the companies.
The development presents a firmware-based alternative to the traditional discrete TPM approach. For device makers, the remaining test will be whether the implementation, firmware-update process, key management, and long-term support model meet the security and compliance requirements of their specific products.