Security by design, now a legal requirement.
The Cyber Resilience Act covers hardware and software that connects to a device or network. Manufacturers must design for security, handle vulnerabilities for years after sale, and report serious problems within 24 hours. Reporting already applies.
A technical view, not legal advice. Facts checked against the official sources below on 1 November 2026.
- Manufacturers of products with digital elements sold in the EU
- Software products, including standalone software
- Importers and distributors of those products
- Not products covered by MDR or IVDR, which have their own rules
- 10 Dec 2024 In force.
- 11 Jun 2026 Rules for conformity assessment bodies apply.
- 11 Sep 2026 Reporting of exploited vulnerabilities and severe incidents applies, also for products already on the market.
- 11 Dec 2027 All requirements apply.
Security for the whole life of the product.
Security by design
Design, build and ship to the essential cybersecurity requirements, backed by a documented risk assessment.
Know your components
Due diligence on third-party and open-source components, and a software bill of materials (a list of every component inside).
Support period
Handle vulnerabilities and provide security updates for at least five years, or the expected use time if shorter, with the end date clear at purchase.
Report fast
Actively exploited vulnerabilities and severe incidents: early warning within 24 hours and a notification within 72 hours, to the national CSIRT and ENISA.
From requirement to working system.
For most manufacturers, the hard part is not the rules. It is knowing what software is in every product, and being able to act on it within a day.
- Map which products and software are in scope
- Build component inventories and software bills of materials
- Set up vulnerability handling and a 24-hour reporting path
- Bring security into the development lifecycle, not just the release
What does this mean for your systems?
Tell us what you build or run. We will give you a straight, technical answer.
Book a consultation