The new Cyber Resilience Act is the first EU regulation on the cyber security of products with digital elements. This includes not only software products, but also smart devices – from connected refrigerators to computer network devices.
Software security has been a constant challenge since the dawn of the Internet. Every month, new security vulnerabilities are discovered which affected organizations then try to fix as quickly as possible. When security updates fail or are unavailable, it is easy for hackers to compromise the affected systems. Since modern electronic devices – from toys to washing machines to cars – also contain many different software products, the challenge of insecure software affects not only the traditional software industry but also a large part of the manufacturing industry.
Cyber Resilience Act regulates all products with digital elements and online services
To address these challenges, the EU introduced the new Cyber Resilience Act, which was published in the Official Journal of the EU this week. This EU regulation applies to all products with digital elements. It covers not only traditional software products and computer hardware, but also smart devices such as connected washing machines.
Moreover, it covers any online service that is connected to the regulated product and without which the product cannot fulfill one of its functions. Therefore, the Cyber Resilience Act is not only an instrument of product safety regulation but also covers many types of online services. For example, if an online service is accompanied by an app that facilitates the use of the online service on a mobile device, the Cyber Resilience Act would likely apply to the entire online service.
The Cyber Resilience Act will take effect in stages, with the obligation to notify actively exploited vulnerabilities for in-scope products taking effect from 11 September 2026 and the remaining obligations from 11 December 2027. Organisations have, by the standards of recent EU legislation, a more reasonable timeframe for implementation; however, as the Cyber Resilience Act is likely to require many organisations to make significant changes to the way they launch and maintain in-scope products in the EU, there is no time to waste.
Obligation to assess risks
Manufacturers which consider developing a product with digital elements will first have to conduct an assessment of the cybersecurity risks associated with the product. The result of this assessment must be taken into account in the further planning, design, development and manufacturing of the product as well as in its delivery and maintenance. Based on the results of this risk assessment, the manufacturer is subject to a number of obligations to ensure an appropriate level of cybersecurity.
Duty to ensure security
Manufacturers are prohibited from making available on the market products with known exploitable vulnerabilities or products without a secure-by-default configuration.
If a security vulnerability is discovered, manufacturers are also obliged to provide security updates without delay and free of charge. Additionally, manufacturers also have to provide automated security updates that are installed within an appropriate timeframe enabled as a default setting.
According to the Cyber Resilience Act, the support period for products with digital elements – i.e. the period for which users can expect the provision of security updates – has to reflect the time the product is expected to be in use.
Obligation to provide information
According to the Cyber Resilience Act, manufacturers must transparently state the end date of this support period. This is intended to also help users compare products and make more informed purchasing decisions.
Furthermore, manufacturers will be subject to a number of additional information obligations. For example, manufacturers will have to provide a list of circumstances that could lead to significant cybersecurity risks, put in place coordinated vulnerability disclosure policies and establish a single point of contact where information about vulnerabilities discovered in the product can be reported.
Obligation to assess conformity
All manufacturers will have to subject their products with digital elements to a conformity assessment procedure and issue a declaration of conformity confirming that the product meets the essential requirements of the Cyber Resilience Act. This declaration of conformity and the technical documentation may also be requested for inspection by the national authorities. The manufacturer has to affix a “CE” marking, thereby declaring that the product complies with requirements under the Cyber Resilience Act.
Obligation to recall products
Under the Cyber Resilience Act, manufacturers will also be obliged to withdraw or recall products from the market if they are aware or have reason to believe that a regulated product does not comply with the technical security requirements of the Cyber Resilience Act. In the event of non-compliance, the competent national market surveillance authority may also order a recall. In cases of a significant cybersecurity risk, the EU Commission, too, may order a recall.
Obligation to disclose security vulnerabilities
Under the Cyber Resilience Act, manufacturers will have to report any actively exploited vulnerabilities in their products that they become aware of within 24 hours via a central reporting platform to be set up by the European Cyber Security Agency (ENISA). In addition, manufacturers will also have to share and publish information about the eliminated vulnerability after providing corresponding security updates. This obligation includes a description of the vulnerability that allows users to assess its impact and severity, as well as instructions on how users can fix the vulnerability.
Obligations for importers and distributors
In addition to manufacturers, the Cyber Resilience Act also imposes obligations on importers and distributors. They must ensure that they only import and sell products with digital elements on the European market that meet the basic requirements of the Cyber Resilience Act and for which the manufacturers have provided the necessary information. This also includes being able to prove to the authorities that the manufacturer has carried out the conformity procedure, prepared technical documentation and affixed a “CE” mark to the product.
If the importer or distributor has reason to believe that one of the products they import or distribute does not comply with cybersecurity requirements, they must establish conformity by means of corrective measures or withdraw the product from the market or recall it. If the importer or distributor becomes aware of a vulnerability, they must immediately inform not only the manufacturer, but also the market surveillance authorities of the Member States in which they have made the product available.
Fines for non-compliance with obligations
In the event of noncompliance with the Cyber Resilience Act, manufacturers face fines of up to EUR 15 million or 2.5% of their annual global turnover, whichever is higher. Other actors face fines of up to EUR 5 million or 1% of annual worldwide turnover.
Obligations in installments
Given that manufacturers will have to fundamentally revise their development processes, the Cyber Resilience Act does not enter into force immediately. The obligation of manufacturers to report security vulnerabilities will apply from 11 September 2026, other obligations from 11 December 2027.
Products with digital elements that are placed on the market before 11 December 2027 and are not substantially modified thereafter are exempt from the obligations of the Cyber Resilience Act, except for the obligation to report security vulnerabilities which will nevertheless apply.
Conclusion
With the Cyber Resilience Act, for the first time, cyber security of products with digital elements, including software and smart devices, will be subject to strict regulation across the EU. This poses major challenges for both the software industry and a large part of the manufacturing industry. Companies should begin now to tackle the implementation of the new requirements in order to be able to launch legally compliant products once the regulation comes into force.
