Company strengthens product security and post-market vulnerability management in line with the EU’s evolving cybersecurity requirements

Silicon Motion Technology Corporation (NasdaqGS: SIMO), a global leader in designing and marketing NAND flash controllers for solid-state storage devices, today announced that it has completed the first stage of its compliance program for the European Union Cyber Resilience Act (CRA). Following a comprehensive internal assessment, the company has aligned its product cybersecurity controls and processes with the CRA’s incident-reporting obligations that take effect on September 11, 2026, and has established vulnerability-handling processes covering key areas contemplated by the CRA, as part of its ongoing CRA readiness efforts. This milestone underscores Silicon Motion’s commitment to product security and provides customers with a trusted foundation for addressing evolving cybersecurity requirements for products with digital elements in the European Union. This is a preparatory step ahead of the CRA’s full application on December 11, 2027, and Silicon Motion will continue to evolve its program as remaining implementing guidance and harmonized standards are further developed and finalized.

“As AI expands across data centers, edge devices and Physical AI applications, cybersecurity has become an essential part of product development,” said Wallace C. Kou, President and Chief Executive Officer of Silicon Motion. “This initial CRA compliance milestone demonstrates our strong commitment to product security and our determination to deliver secure products that serve as a trusted foundation for customers to build resilient storage solutions.”

To meet the requirements applicable at this stage, Silicon Motion has strengthened its post-market vulnerability management and incident-reporting processes. Key measures include:

• Security management and due diligence for third-party hardware and software components
• Continuous vulnerability monitoring, coordinated disclosure and timely remediation
• Incident escalation and reporting procedures aligned with CRA notification requirements
• Defined security support and vulnerability-handling processes throughout the product lifecycle

To support timely vulnerability handling, Silicon Motion has also established a dedicated security vulnerability reporting channel on its website, enabling customers, end users and other stakeholders to report suspected security issues directly to the company for timely investigation and response.

These measures span Silicon Motion’s full product portfolio, including enterprise SSD controllers, enterprise boot drive solutions, edge SSD controllers, embedded eMMC and UFS controllers, Ferri solutions for automotive and Physical AI, and display interface solutions. By strengthening cybersecurity and vulnerability management across its portfolio, Silicon Motion helps customers build secure solutions and remains committed to aligning its practices with evolving CRA guidance and harmonized standards.

This press release contains statements regarding Silicon Motion’s cybersecurity and regulatory compliance initiatives in preparation for compliance with the CRA; however, these initiatives should not be construed as a representation that Silicon Motion or its products are currently compliant with the CRA. Certain CRA requirements, including applicable specifications and harmonised standards, remain subject to further development, publication, and regulatory guidance.