Cyber Resilience Act

Vulnerabilities in software and networked devices have long been no mere question of customer service. The Cyber Resilience Act, Regulation (EU) 2024/2847, regulates cybersecurity requirements for certain products with digital elements. Manufacturers should consider product development, vulnerability management and contract design together. We clarify the legal scope and support in the assignment of duties.

Which products and companies are covered

The starting point is products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection. In addition to hardware, software can be affected. A remote processing solution required to function may be part of the product. On the other hand, an independent cloud service does not fall under the CRA because it uses software.

Manufacturers, importers and distributors as well as special roles in free and open source software shall be examined. For certain products there are sectoral exceptions. The delimitation of non-commercial open source development from a provision within the scope of a business activity also requires a concrete consideration. The term "Open Source" alone does not answer the question.

What to consider since September 2026

Most material requirements apply from the 11 December 2027. However, the reporting requirements for manufacturers referred to in Article 14 have already been applicable since the 11 September 2026. This concerns actively exploited vulnerabilities and serious security incidents that affect the safety of a captured product. Not every vulnerability found triggers the same reporting requirement.

For these notifications, graduated deadlines apply: in principle an early warning within 24 hours and a further notification within 72 hours after knowledge has been obtained. The requirements for the final report differ. In the case of an actively exploited vulnerability, reports shall be reported no later than 14 days after a remedial action is available; in the case of a serious incident, in principle, within one month of the 72-hour notification. The relevant facts must therefore be established at an early stage.

The notification shall be made via the European platform provided for this purpose. Other obligations may also exist, for example under data protection law or the BSIG. An internal alert plan should distinguish and coordinate these procedures. The special obligations of open source software stewards have their own application date; they must not be equated with the manufacturer's obligations.

Preparation for further product obligations

A product directory is required for the implementation: product family, functions, provision, intended users, technical dependencies and responsible persons. Cybersecurity risk assessment, development requirements, technical documentation and the appropriate conformity assessment procedure are built on this. The classification of important or critical products influences the process.

The support period and the provision of security updates must be planned in a legally and technically sustainable manner. This also applies to purchased components and the question of how weak points become known in dependencies. A software piece list can help with this, but does not replace the legal role check or the processing of concrete security messages.

What belongs in the Treaties

Contracts with developers and suppliers should regulate security requirements, information on components, update obligations and cooperation in case of incidents. It is necessary to determine who prepares which notification and what information must be provided within the internal deadline. Public-law producer obligations are not transferred to the service provider in any way by a contractual clause.

Customer contracts also require a comparison with product description, support commitments and update concept. Flat-rate exclusions of liability do not resolve a contradiction between promised useful life and actual security.

Legal monitoring of a CRA project

We can take over the classification of individual products, the distribution of duties in a supply chain or the revision of development and distribution contracts. A technical safety test or a necessary conformity assessment shall be carried out by competent specialised bodies. Product documentation, sales model, essential components and existing support arrangements should be compiled for entry. Contact to the firm.

Legal basis and decisions: Cyber Resilience Act – Regulation (EU) 2024/2847; European Commission: CRA reporting requirements; European Commission: Timetable for implementation.

Situation as at 2 November 2026.

Further reading: Product safety, CE marking and recalls · Software businesses · Data protection and IT security