cyber resilience act

NIS2 puts duties on organisations. The Cyber Resilience Act puts duties on products. It covers hardware and software, plus any remote data processing the manufacturer designed as part of the product, whenever the product can connect to a device or a network, directly or indirectly.

You are a manufacturer if you develop or build such a product, or have it built, and sell it under your own name or trademark. Free of charge counts. You are an importer if you are in the EU and place on the market a product that carries the name of a company outside the EU. You are a distributor if you pass a product along the supply chain without changing it. Open-source software stewards are legal persons, other than manufacturers, that systematically support specific open-source products meant for commercial use. They get lighter duties: a security policy, cooperation with the authorities, and reporting.

Some products are left out because other rules cover them: medical devices, motor vehicles, certified aviation products, spare parts and products made only for national security or defence. A website, or a cloud service built outside a product maker’s responsibility, is not a product. Software as a service stays under NIS2. By the wording of the definition, software you write and use only inside your own company is not made available on the market. The Commission’s guidance of 27 July 2026 shows where the borders run, with examples. It is not binding, and it was not read in detail for this page.

Most products fall in the default band. The manufacturer checks its own product and signs the declaration, using the internal control procedure.

Important products are listed in annex III. The two classes below set how strict the assessment is. Class I includes identity and privileged access management software, browsers, password managers, anti-malware software, VPN products, network management systems, SIEM systems, operating systems, routers, modems and switches, and some smart home and wearable products. Class II is narrower: hypervisors and container runtimes, firewalls and intrusion detection and prevention systems, and tamper-resistant microprocessors and microcontrollers. For Class II the manufacturer must use a third-party procedure or a certification scheme. For Class I the same applies unless the manufacturer has fully applied harmonised standards, common specifications or a certification scheme at least at the substantial level.

Critical products are listed in annex IV: hardware devices with security boxes, smart meter gateways, and smart cards or similar secure elements. The Commission can require a European cybersecurity certificate for them through a delegated act. Without one, they follow the Class II procedures.

Building an important product into a larger product does not make the larger product important.

• 10 December 2024. The regulation entered into force.
• 11 June 2026. The chapter on notified bodies (articles 35 to 51) applies.
• 11 September 2026. The manufacturer’s reporting duty applies. This is the one in force today.
• 11 December 2027. The rest of the regulation applies.

Products placed on the market before 11 December 2027 fall under the requirements only if they are substantially modified after that date. The reporting duty is the exception: it applies to all products in scope, including ones placed on the market before that date. Open-source stewards report from 11 December 2027, according to the Commission’s reporting page.

Build security in. Before placing a product on the market, the manufacturer assesses its cybersecurity risks, documents the assessment, and keeps it updated during the support period. The product must meet the requirements in annex I part I: no known exploitable vulnerabilities at release, secure defaults with a reset option, updates for security flaws, access control, protection of data in storage and in transit, data minimisation, limited attack surface, logging, and secure removal of user data. Third-party components, including open-source ones, need due diligence.

Handle vulnerabilities. Annex I part II asks for a record of the product’s components in a software bill of materials in a commonly used, machine-readable format that covers at least the top-level dependencies. It asks for security updates without delay, regular security testing, public information about fixed vulnerabilities, a coordinated vulnerability disclosure policy, a contact address for reports and secure distribution of updates. A single point of contact for users is also required.

Set a support period. It reflects how long the product is expected to be in use and is at least five years, unless the product is expected to be used for less. The end date, with at least month and year, is stated at purchase. A security update stays available for at least 10 years or the rest of the support period, whichever is longer.

Prove it. The manufacturer writes technical documentation, runs the conformity assessment procedure for the product’s band, draws up the EU declaration of conformity and affixes the CE marking. It keeps the documentation and the declaration for at least 10 years, or for the support period if that is longer.

A manufacturer reports every actively exploited vulnerability in its product, meaning one with reliable evidence that a malicious actor has exploited it without the system owner’s permission. It also reports every severe incident that affects the security of the product. Three steps follow in each case: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report. The final report is due no later than 14 days after a fix or mitigation is available for a vulnerability, and within one month of the 72-hour notice for an incident.

The manufacturer reports once, through the single reporting platform that ENISA (the EU cybersecurity agency) runs. The report goes to the national CSIRT (the national incident response team) of the country where the manufacturer has its main establishment in the EU. ENISA sees it at the same time. According to the Commission, the platform has been operational since 11 September 2026. The manufacturer also has to tell affected users, with mitigation steps where there are some.

Micro and small manufacturers are exempt from the fine rules for missing the 24-hour early-warning deadline.

National market surveillance authorities enforce the regulation, and each country sets its own penalty rules, which must be effective, proportionate and dissuasive. The regulation sets these ceilings for fines:

• up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaches of the annex I requirements and of the manufacturer’s core duties and reporting
• up to €10 million or 2% for breaches of other listed duties, among them those of importers and distributors, the declaration of conformity, the CE marking, technical documentation and the conformity assessment procedures
• up to €5 million or 1% for supplying incorrect, incomplete or misleading information to authorities or notified bodies

The size of the company and its market share are among the circumstances that authorities weigh. The text also takes open-source stewards out of the fines in paragraphs 3 to 9. How that carve-out and the one for micro and small manufacturers interact with the first ceiling is a question for your lawyer. Check your national law for the name of the authority and the penalty rules.

NIS2. The Commission says the CRA complements NIS2. NIS2 covers how an organisation runs its security, including the security of its supply chain, and it still governs cloud services. The CRA covers the product that arrives in that supply chain. A reasonable reading: if you are a NIS2 entity, the CRA gives you something concrete to ask your product suppliers, on top of the questions in the supplier work.

AI Act. A product with digital elements that is also a high-risk AI system is deemed to meet the AI Act’s cybersecurity requirement if it meets the CRA’s annex I requirements and the manufacturer’s processes meet part II, and if the EU declaration of conformity shows that the level of protection required by the AI Act is reached. The AI Act’s own conformity assessment procedure applies, and notified bodies that handle it may, under conditions the text sets, also check the CRA requirements.

The CRA does not require you to ask any of this as a buyer, and most suppliers will not have answers ready before December 2027. They are reasonable questions to start with now.

• Does the supplier consider itself a manufacturer under the CRA, and in which band does it place the product?
• What is the end date of the support period, and where is it stated?
• Who do we contact about a vulnerability, and what is the disclosure policy?
• How will you tell us about an actively exploited vulnerability or a severe incident in the product? The regulation obliges the manufacturer to inform affected users.
• Can you share the software bill of materials? The SBOM is a record the manufacturer keeps. The text read for this page does not say it goes to customers, and annex II, which lists what users receive, was not read. If you want it, ask in the contract.
• From December 2027, does the product carry the CE marking, and is there an EU declaration of conformity?

Public bodies have a rule of their own: national procurement has to take the annex I requirements, including the manufacturer’s ability to handle vulnerabilities, into account. For older products already in use, only the reporting duty reaches them before they are substantially modified.