Cyber Resilience Act: if you sell software or connected products

What the regulation asks

EU regulation 2024/2847 covers products with digital elements: installable programs, apps, firmware, connected devices. The manufacturer is whoever sells them under their own name, even if someone else developed them.

Since 11 September 2026 manufacturers have to report actively exploited vulnerabilities and severe incidents on the single platform run by ENISA: an early warning within 24 hours, the notification within 72, a final report afterwards. The regulation applies as it stands across the EU, Italy included.

The other obligations arrive on 11 December 2027: security from the design stage, vulnerability handling for the product's whole life, CE marking. Fines go up to EUR 15 million or 2.5% of worldwide turnover. The Commission published its guidance on 27 July 2026.

What you need in practice

To report within 24 hours you have to know you have the problem. So first of all you need:

• the list of components in every version sold (the SBOM), generated with each release;
• a public address for anyone who finds a flaw, and someone who reads it;
• an automatic check for known vulnerabilities in those components;
• a safe way to get fixes to customers, separate from updates with new features;
• a written procedure: who decides, who reports, with which access to the platform.

What I do

I work on the code and on how it's released. I put the component list and the vulnerability check into the release, with tools like composer audit and npm audit, clear out abandoned libraries and sort the update channel, for desktop apps too. If the program is old and nobody knows what's inside, I start from the inventory.

We write the procedure together, starting from who really answers the phone on a Saturday.

What this doesn't cover

Conformity assessment, CE marking and the final technical file need a consultant, and a notified body for some product categories. I prepare the code and process they rest on. This page summarises rules as read on 30 October 2026 and is not legal advice.

If your company is in Switzerland, see Cyber Resilience Act for Swiss exporters.

Frequently asked questions

We're a SaaS. Are we in scope?

Software used only in the browser, with nothing to install, is usually outside and falls under NIS2 instead. That changes with an app to download, an agent the customer installs or a device that can't work without your server: that part is in, and the remote service may come with it.

We build custom software for a single customer. Are we in?

Readings differ. Germany's BSI writes that the regulation also applies to custom-made products, whatever the number of units. Have a lawyer check your case, and meanwhile keep components and updates in order: you need that anyway.

We sold our software years ago.

The reporting duty also covers products placed on the market before 11 December 2027. The other obligations concern products from that date on, and a substantial change can make a product count as new.

We use open source components. Does that change anything?

Whoever sells the product also answers for what they put inside it. That's why you need the list: when a flaw appears in a library, you have to know within ten minutes which versions of your product contain it.

Read more

• The service: Hacked sites and security
• More pages like this: New rules to comply with