EU Cyber Resilience Act

What it is

Regulation (EU) 2024/2847, the Cyber Resilience Act, sets horizontal cybersecurity requirements for hardware and software products with digital elements sold on the EU market. It requires products to be designed securely, to be supported with security updates throughout a defined support period, and to have their vulnerabilities handled properly. It exists because many connected products reached the market with weak security and little support, and buyers could not tell which were secure.

Who it applies to

• Manufacturers of products with digital elements, meaning hardware and software, including components, whose intended use includes a data connection to a device or network
• Importers and distributors placing such products on the EU market
• Open-source software stewards, which have a lighter set of obligations; open-source software supplied outside a commercial activity is not covered
• Products in the important (class I and II) and critical categories, such as identity management software, password managers, VPNs, firewalls, operating systems and hardware security modules, face stricter conformity assessment
• Products already covered by specific EU rules, such as medical devices, motor vehicles and civil aviation, are excluded, and pure software as a service is generally out of scope unless it is a remote data processing solution for a product

Key points

• Products must be designed, developed and produced with a level of cybersecurity appropriate to the risks, based on a documented cybersecurity risk assessment
• Annex I security properties include secure default configuration, protection against unauthorised access, protection of confidentiality and integrity, minimised attack surface and the ability to receive security updates
• Manufacturers must handle vulnerabilities throughout the support period, which should generally be at least five years unless the product is expected to be used for a shorter time
• Manufacturers must identify and document components, including by drawing up a software bill of materials, and have a coordinated vulnerability disclosure policy
• Actively exploited vulnerabilities and severe incidents must be reported through the single reporting platform, with an early warning within 24 hours and a notification within 72 hours, followed by a final report
• Most products can use self-assessment, while important and critical products need harmonised standards, third-party assessment or certification

Where to start

1. 1List the products you place on the EU market and classify each as default, important class I, important class II or critical
2. 2Set up the vulnerability handling process now, including a disclosure policy, SBOM generation and a way to meet the 24 hour reporting deadline from 11 September 2026
3. 3Run a cybersecurity risk assessment per product against Annex I and decide the support period you will commit to
4. 4Ask your component and open-source suppliers how they will support your CRA obligations