The Cyber Resilience Act

What the Cyber Resilience Act requires and when

The Cyber Resilience Act (Regulation (EU) 2024/2847) introduces mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market, and extends the CE marking to cybersecurity. It entered into force on 10 December 2024 and applies in three stages. The provisions on notification of conformity assessment bodies have applied since 11 June 2026. The reporting obligations for actively exploited vulnerabilities and severe incidents in Article 14 have applied since 11 September 2026. All other obligations, including the essential cybersecurity requirements and conformity assessment, apply from 11 December 2027 (Article 71).

For German manufacturers of machinery, consumer electronics, industrial controls, software and IoT devices, the Cyber Resilience Act is now a live compliance topic: reporting is already mandatory for all products in scope, including those placed on the market before December 2027, and product development cycles mean that products launched from 2027 must be designed to the new requirements now.

Which products are covered

The regulation applies to products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. This covers connected hardware, standalone software and remote data processing solutions that are necessary for a product to perform its functions. Products already covered by specific EU rules with equivalent cybersecurity requirements, such as medical devices, motor vehicles and certain aviation and marine equipment, are excluded, and products developed exclusively for national security or defence purposes are outside its scope.

Free and open-source software is covered only when it is made available in the course of a commercial activity. Open-source software stewards — legal persons that systematically support the development of open-source products intended for commercial activities — are subject to a light-touch regime: a documented cybersecurity policy, cooperation with market surveillance authorities and, to the extent they are involved in development, reporting (Article 24).

Software and cloud services

Standalone software, such as desktop applications, mobile apps, firmware and operating systems, is a product with digital elements in its own right. Pure software as a service is generally not covered as such; it is regulated as a service under NIS2. However, remote data processing solutions — data processing at a distance whose absence would prevent the product from performing one of its functions, such as the cloud backend of a smart home device — are part of the product and must meet the requirements. Manufacturers of connected devices therefore need to include their backend infrastructure in their security design and documentation.

Obligations of manufacturers

Article 13 requires manufacturers to design, develop and produce products in accordance with the essential cybersecurity requirements in Part I of Annex I, based on a documented cybersecurity risk assessment. These requirements include security by default, protection against unauthorised access, confidentiality and integrity of data, data minimisation, availability of essential functions, limiting attack surfaces, logging and the ability to address vulnerabilities through security updates.

Manufacturers must also handle vulnerabilities effectively throughout the support period, in accordance with Part II of Annex I: identify and document components (including a software bill of materials), remediate vulnerabilities without delay, test regularly, publish information on fixed vulnerabilities, operate a coordinated vulnerability disclosure policy and distribute security updates securely and, in principle, free of charge. The support period must reflect the time the product is expected to be in use and must in principle be at least five years, unless the product is expected to be in use for a shorter time (Article 13(8)). Industrial equipment that customers use for ten years or more will typically require a correspondingly longer support period, which has to be reflected in pricing, component selection and contracts with chip and software suppliers.

Before placing a product on the market, manufacturers must carry out the applicable conformity assessment (Article 32), draw up technical documentation and an EU declaration of conformity, and affix the CE marking.

Importers and distributors

Importers must place only compliant products on the market and must check that the manufacturer has carried out the conformity assessment, drawn up the technical documentation, affixed the CE marking and provided the required information and instructions.

They must indicate their name and contact details on the product and inform the manufacturer and authorities of vulnerabilities and risks they become aware of. Distributors must verify the CE marking and that manufacturer and importer have met their information duties. For German trading companies that import connected devices from outside the EU, these duties are a significant change: their supplier contracts should require evidence of compliance, cooperation on vulnerabilities and security updates for the support period.

Any economic operator that places a product under its own name or substantially modifies it is treated as a manufacturer.

Reporting obligations since September 2026

Since 11 September 2026, manufacturers must notify actively exploited vulnerabilities and severe incidents having an impact on the security of their products simultaneously to the CSIRT designated as coordinator and to ENISA via the single reporting platform (Article 14). The obligations apply to all products within scope, including those placed on the market before 11 December 2027 (Article 69(3)).

• Actively exploited vulnerability: early warning within 24 hours of becoming aware; vulnerability notification within 72 hours; final report no later than 14 days after a corrective or mitigating measure is available.
• Severe incident: early warning within 24 hours; incident notification within 72 hours; final report within one month after the incident notification.

Manufacturers must also inform affected users, and where appropriate all users, about the vulnerability or incident and any mitigating measures.

Illustration

Illustration (hypothetical): a German manufacturer of building automation controllers learns from a customer on a Friday evening that attackers are exploiting a flaw in the controller's web interface. The 24-hour early warning to the CSIRT designated as coordinator and to ENISA is due by Saturday evening, even if the analysis is incomplete.

Within 72 hours, the manufacturer must submit a vulnerability notification with general information on the product, the exploit and available mitigations, and inform affected users. Once a patch is available, a final report is due within 14 days. If the manufacturer is also an important entity under NIS2 and its own systems were compromised, a separate report to the BSI may be required.

Interaction with NIS2, the AI Act and product liability

The Cyber Resilience Act sits alongside other regimes. Manufacturers that are also essential or important entities under NIS2 have separate incident reporting duties to the BSI under the German BSI Act (BSIG), with deadlines of 24 hours, 72 hours and one month.

High-risk AI systems that meet the Cyber Resilience Act's essential requirements are deemed to comply with the AI Act's cybersecurity requirement to the extent covered. And under the new Product Liability Directive (EU) 2024/2853, which Member States must transpose by 9 December 2026, software is a product and a lack of security updates can make a product defective. A breach of the regulation's requirements can therefore also have civil liability consequences. See our insight on NIS2 management liability.

Enforcement and implementation in Germany

Market surveillance authorities enforce the regulation. Fines can reach EUR 15 million or 2.5% of worldwide annual turnover for breaches of the essential requirements and of Articles 13 and 14, EUR 10 million or 2% for breaches of other obligations, and EUR 5 million or 1% for incorrect information (Article 64).

In Germany, the government bill implementing the regulation (BT-Drs. 21/6134) would make the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) the market surveillance authority and notifying authority and provide rules for fine proceedings, through amendments to the BSI Act, the Telecommunications Act and the Energy Industry Act. The Bundestag's Committee on Internal Affairs recommended adoption with an amendment to the commencement provisions on 14 October 2026 (BT-Drs. 21/8622). Companies should monitor publication in the Federal Law Gazette.

Harmonised standards will be essential for practical compliance, particularly for important products of class I, where applying harmonised standards in full allows self-assessment instead of third-party assessment. The Commission has issued a standardisation request to the European standardisation organisations for horizontal and product-specific standards. Manufacturers should follow this work and plan for the possibility that not all standards will be available well before December 2027, which would push class I products into third-party assessment and increase demand for notified bodies.

Preparing for December 2027

1. Map products with digital elements and classify them (default, important class I or II, critical).
2. Determine your role as manufacturer, importer or distributor for each product.
3. Integrate security by design and risk assessment into product development.
4. Build vulnerability handling: SBOM, disclosure policy, update processes and support period decisions.
5. Plan conformity assessment and, for important products, engage notified bodies early.
6. Review supplier contracts for components, open-source use and update obligations.
7. Align product security with NIS2, AI Act and product liability compliance.

The Cyber Resilience Act also changes the commercial conversation. Customers, especially operators of critical infrastructure and NIS2 entities, will increasingly ask suppliers for evidence of compliance, SBOMs and support period commitments in tenders. Manufacturers that can provide this documentation early may gain a competitive advantage, while those that cannot may find themselves excluded from procurement processes well before the formal deadline. Management should therefore treat product security as a strategic issue rather than a purely technical one.

How TRW & Co helps with the Cyber Resilience Act

We advise manufacturers, importers and distributors on the Cyber Resilience Act: scoping and classification, essential requirements, vulnerability handling, reporting processes, conformity assessment and CE marking. We draft supply chain and component contracts with security and update obligations, coordinate CRA compliance with NIS2 and product liability, and represent clients before the BSI and other market surveillance authorities. See our pages on cybersecurity and NIS2 and product liability and compliance, or contact us.