What it asks for. The Cyber Resilience Act sets horizontal cybersecurity requirements for products with digital elements placed on the EU market, covering hardware and software. Manufacturers must meet essential requirements on secure design and vulnerability handling, provide security updates for a support period, and carry out conformity assessment before CE marking. Reporting of actively exploited vulnerabilities and severe incidents applies from September 2026, with most other obligations from December 2027.
In practice. Manufacturers classify their products, run risk assessments, adopt secure development practices, maintain software bills of materials, define support periods and set up coordinated vulnerability disclosure and reporting channels. Importers and distributors check that products comply. Evidence includes technical documentation, risk assessments, SBOMs and the EU declaration of conformity.
Common gaps. Many manufacturers underestimate the vulnerability reporting duties and the effort to produce SBOMs across their portfolio. Open source dependencies and long support periods are frequent pain points.