Cyber Resilience Act

What it means

The Cyber Resilience Act is an EU regulation requiring makers of hardware and software with digital elements to design products securely, fix vulnerabilities throughout the support period and report actively exploited flaws. It covers routers, smart devices, apps and business software alike.

Unlike NIS2, which deals with the cybersecurity of organisations, the CRA targets the products themselves. Security becomes a condition of market access just like electrical safety, and a product that fails the requirements may not carry the CE marking.

The obligations phase in gradually. Reporting of actively exploited vulnerabilities and severe incidents applies from September 2026, and most other requirements on design, documentation and conformity assessment from December 2027. A stricter regime applies to important and critical product categories.

How it works in practice

The manufacturer must assess risks, ship the product without known exploitable vulnerabilities and with secure default settings, and provide security updates for a defined support period. A list of components used and a process for receiving vulnerability reports are part of this.

Firms that commission custom software for their own use are not directly subject to manufacturer obligations. If they sell it on to customers, however, they become the manufacturer. A software development agreement should therefore make clear who is responsible for updates and reporting.

For IT teams the CRA is good news: products will have clearer support periods and vendors will publish vulnerabilities under CVE identifiers. This makes patch management easier and helps in choosing suppliers who take security seriously.

What to watch out for

Non-compliance can lead to heavy fines and withdrawal of the product from the market. Small software firms and device makers should map early which products fall under the regulation and what conformity assessment they need, because preparing the documentation takes months.

Open-source software developed outside commercial activity is excluded, but a company that builds open-source components into its product is responsible for their security. It is also worth reviewing product liability insurance.