Key dates
| Date | What applies |
|---|---|
| 10 December 2024 | Entry into force of the Regulation |
| 11 June 2026 | Rules on the notification of conformity assessment bodies (Chapter IV) |
| 11 September 2026 | Manufacturers’ reporting obligations (Art. 14), including for products already placed on the market |
| 11 December 2027 | Everything else: essential requirements, conformity assessment, technical documentation, EU declaration of conformity and CE marking |
Who it applies to
The Regulation covers products with digital elements, hardware or software, made available on the European market, whose intended or reasonably foreseeable use involves a direct or indirect logical or physical connection to a device or a network. It includes components placed on the market separately and the remote data processing that the manufacturer designs for the product and without which the product could not perform one of its functions. A cloud service that is not linked to a product does not fall under the Cyber Resilience Act; it may fall under NIS2.
The obligations fall on manufacturers, importers and distributors. Anyone who substantially modifies a product, or sells it under their own name or trademark, is considered a manufacturer.
Excluded are products already regulated by sector legislation: medical devices and in vitro diagnostic medical devices, vehicles type-approved under Regulation (EU) 2019/2144, certified aeronautical products, marine equipment, as well as products developed exclusively for national security or defence purposes and spare parts identical to the originals. Free and open-source software developed outside a commercial activity is not covered; a lighter regime applies to those who provide sustained support to open-source projects intended for commercial activities (the stewards).
Product classes and conformity assessment
| Category | Examples | Conformity assessment |
|---|---|---|
| Products without a class | Most connected products | Internal control by the manufacturer (module A) or, optionally, a notified body |
| Important, class I (Annex III) | 19 categories, including operating systems, browsers, password managers, anti-malware, VPNs, SIEM, routers, modems and switches, smart home security products (locks, cameras, alarm systems) | Internal control only if harmonised standards, common specifications or a European certification at least at “substantial” level are applied in full; otherwise a notified body |
| Important, class II (Annex III) | Hypervisors and container runtime systems, firewalls and intrusion detection and prevention systems, tamper-resistant microprocessors and microcontrollers | Always with a notified body (modules B+C or H) or with a European certification at least at “substantial” level |
| Critical (Annex IV) | Hardware devices with “security boxes”, smart meter gateways, smartcards and secure elements | European cybersecurity certification, when a delegated act makes it mandatory; otherwise as for class II |
The categories are described in detail in Implementing Regulation (EU) 2025/2392. A practical point: from the information available at the beginning of November 2026, no harmonised standard for the Cyber Resilience Act appears yet to have been cited in the Official Journal of the European Union. Until one is, a class I product cannot rely on internal control and will probably have to go through a notified body.
What the manufacturer must do
- Assess the cybersecurity risk of the product and use the results in design, development, production, delivery and maintenance.
- Meet the essential requirements of Annex I, Part I: no known exploitable vulnerabilities when placed on the market, secure-by-default configuration, protection against unauthorised access, confidentiality and integrity of data, reduction of the attack surface, logging of events, ability to receive security updates.
- Manage vulnerabilities (Annex I, Part II): software bill of materials (SBOM) in a machine-readable format, covering at least top-level dependencies; remediation without delay; security updates distributed free of charge; a coordinated vulnerability disclosure policy and a contact point for receiving vulnerability reports.
- Ensure a support period equal to the expected use time of the product and of at least five years, unless the product is expected to be in use for less. Each security update must remain available for at least ten years or for the remainder of the support period, if longer.
- Report vulnerabilities found in components, including open-source ones, to those who develop or maintain them.
- Document: technical documentation (Annex VII), EU declaration of conformity (Annex V), information and instructions for the user (Annex II), including the end date of the support period and the contact point; then CE marking.
Reporting, already in force
The situation in November 2026 and what to do now →
Since 11 September 2026 the manufacturer must report, simultaneously to the CSIRT designated as coordinator in the country where it has its main establishment and to ENISA, via the single reporting platform:
| Event | Early warning | Notification | Final report |
|---|---|---|---|
| Actively exploited vulnerability | Within 24 hours | Within 72 hours | Within 14 days of a corrective or mitigating measure becoming available |
| Severe incident having an impact on the security of the product | Within 24 hours | Within 72 hours | Within one month of the notification |
The deadlines run from when the manufacturer becomes aware of the event. The manufacturer must also inform the affected users and indicate the measures they can take. If the company is also a NIS2 entity, the same event may require a separate notification to CSIRT Italia under Legislative Decree 138/2024.
Penalties
| Infringement | Maximum |
|---|---|
| Essential requirements of Annex I, obligations under Arts. 13 and 14 | €15 million or 2.5% of worldwide annual turnover, if higher |
| Other obligations, including those of importers and distributors | €10 million or 2% of turnover, if higher |
| Incorrect, incomplete or misleading information to authorities or notified bodies | €5 million or 1% of turnover, if higher |
Micro and small enterprises cannot be fined for missing the 24-hour early warning deadline, but they can be for everything else. Open-source stewards are exempt from administrative fines.
In Italy
On 2 October 2026 the Council of Ministers gave preliminary approval to the draft legislative decree adapting national law to the Regulation. The draft designates the National Cybersecurity Agency (ACN) as the market surveillance authority and as the notifying authority for conformity assessment bodies, and provides for a regulatory sandbox under ACN supervision. The text is not yet final and may change. The European Regulation, on the other hand, is already directly applicable.
Cyber Resilience Act and NIS2
The two pieces of legislation complement each other: NIS2 concerns the organisation and the services it provides, the Cyber Resilience Act the products it places on the market. A manufacturing company may be subject to both, with different measures, notifications and authorities. It makes sense to manage them with a single system: the same risk register, the same suppliers, the same process for incidents and vulnerabilities.