◢What is the Cyber Resilience Act?

It is Regulation (EU) 2024/2847. According to the Commission, it sets mandatory cybersecurity requirements for hardware and software sold in the European Union. It entered into force on 10 December 2024 and applies to "products with digital elements", the official name for almost anything that runs software: an IP camera, a router, an industrial controller, a mobile app, or a management program installed on a customer's computer.

Until now, the security of these products depended on the manufacturer's goodwill. The regulation makes it a condition for selling them in Europe, in the same way other requirements are shown with the CE marking.

◢Which products does it cover, and which not?

◢Which two dates matter?

• ▹11 September 2026: the reporting obligations of Article 14 already apply.
• ▹11 December 2027: the rest of the main obligations apply.

According to the Commission summary, products already on the market before December 2027 fall under the other obligations only if they undergo a substantial modification after that date. The reporting obligations, however, apply to all products made available, including those already on sale.

◢What must a manufacturer report, and how fast?

• ▹An early warning within 24 hours of becoming aware.
• ▹A full notification within 72 hours.
• ▹A final report no later than 14 days after a corrective measure is available, for an exploited vulnerability. For a severe incident, within a month of the 72-hour notification.

Everything is submitted once, through the single reporting platform run by ENISA, the EU cybersecurity agency, which the Commission says has been operational since 11 September. The notification goes to the CSIRT of the country where the manufacturer has its main establishment and, unless there are exceptional circumstances, to ENISA as well.

The Commission adds a detail for smaller firms: micro and small enterprises cannot be fined for missing the 24-hour deadline.

◢What if I only import or distribute other people's products?

You are not off the hook, although these duties arrive with the other main obligations in December 2027. The Commission summary says the importer, who places on the EU market products carrying the name or trademark of a manufacturer from outside, must check that the manufacturer has met its obligations, that the conformity assessment was carried out and that the product bears the CE marking. If not, it cannot put the product on the market.

The distributor, who sells the product without changing it, must also verify the CE marking and that the manufacturer and importer have done their part, including contact details, user instructions and the support period. Anyone who resells connected equipment to customers (installers, integrators, shops) should know this will stop being optional.

◢What changes if my company only buys these products?

If you only buy, the regulation puts no direct obligations on you, but it changes what you can ask for. According to the Commission, the manufacturer must set a support period, during which it has to handle vulnerabilities effectively, and the end date (month and year) must be clear at the time of purchase.

That is genuinely useful. When the attacks on European supermarket refrigeration hit the news, the manufacturers said most of the affected equipment was discontinued and no longer received updates. The regulation will not fix those old devices, but it does require new ones to say how long they will be looked after.

◢What to do now

If you make, import or distribute products with software:

• ▹Work out whether your products fall within the regulation. Start with the Commission's guide and FAQs.
• ▹Decide who in the company will receive the alert about an exploited vulnerability and how the early warning will go out within 24 hours. That is what the law already requires.
• ▹Ask your component and third-party software suppliers how they handle vulnerabilities. As a manufacturer, you answer for what you integrate.

If you only buy:

• ▹Before acquiring connected equipment (cameras, controllers, locks, industrial devices), ask until when it will get security updates.
• ▹Put that date in your equipment inventory, next to who installed it and who can reach it from outside. I have written elsewhere that attacks rarely come in through the server, but through whatever nobody was keeping track of.

Understanding what the rule demands of you, and what you can demand in return, is part of what I teach in my cybersecurity training for companies, designed for teams that are not technical.