EU Cyber Resilience Act mandates security updates for all digital products by 2027
The European Union’s new Cyber Resilience Act requires manufacturers to design products with secure defaults and update capabilities, with reporting duties starting in September 2026.
Key points
- The Cyber Resilience Act applies to all products with digital elements sold in the EU market.
- Manufacturers must ensure products can be updated when security issues are discovered.
- Initial reporting requirements begin in September 2026, with full enforcement in December 2027.
The European Union is implementing the Cyber Resilience Act, a comprehensive regulation that imposes strict cybersecurity requirements on hardware and software products sold within its borders, according to InfoWorld. This legislation targets any product containing a digital component, forcing manufacturers to build security into the design process rather than treating it as an afterthought.
The Act mandates that all affected products must be capable of receiving updates when security vulnerabilities are identified. This requirement ensures that devices remain secure throughout their lifecycle. Manufacturers must also adhere to thirteen specific guidelines covering data privacy, secure default configurations, and protection against unauthorized access.
Regulatory Timeline and Requirements
The timeline for compliance is approaching faster than many developers may realize. While the full Cyber Resilience Act comes into force in December 2027, the first reporting requirements began in September 2026, according to InfoWorld. Products must meet thirteen guidelines under the Act. These rules dictate how data created during use is handled, kept private, and secured.
Key technical requirements include ensuring that the default configuration of any product is secure. Manufacturers must prevent unauthorized access and hold data securely. The software implemented on any device must be capable of being updated to a more secure version. Additionally, products should launch without any known vulnerabilities, requiring a clean software bill of materials.
Scope and Impact on Manufacturers
The Cyber Resilience Act applies to all products that include a digital component made available for sale to customers in the EU region. This coverage extends to manufacturers of smartwatches, smartphones, data center equipment, and industrial machinery. It also impacts producers of all software that runs on these devices, whether the products are made by the companies themselves or are part of a larger distribution chain.
Many developers outside the EU are not familiar with this regulation, according to InfoWorld. Not understanding the scope of the Act could lead to sales being blocked or result in potential fines. The rules also cover data management over time. Customers must be able to delete their data from a device and copy or move their data off the product.
Companies are encouraged to avoid capturing data that they do not need to provide the service. The biggest hurdle for software teams is ensuring that products launch without known vulnerabilities. If a fault is discovered later, the ability to update the software is critical. A clean software bill of materials is essential for meeting these standards.
What should you do?
Security professionals should review their product portfolios to identify any items with digital components sold in the EU. Teams must verify that their software architecture supports secure updates and that default configurations are hardened. Developers should begin compiling accurate software bills of materials to track components and potential vulnerabilities.
What to do and how to stay safe: Cyber Resilience Act
- Audit all products with digital elements intended for the EU market to ensure they meet the thirteen CRA guidelines.
- Implement mechanisms that allow for secure software updates to address vulnerabilities discovered after launch.
- Ensure default configurations are secure and that unauthorized access is prevented by design.
- Maintain a clean software bill of materials to track components and facilitate rapid response to security issues.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When does the Cyber Resilience Act come into full force?
The full Act comes into force in December 2027, although initial reporting requirements began in September 2026.
What types of products are covered by the Cyber Resilience Act?
The Act applies to all products with digital elements sold in the EU, including smartwatches, smartphones, data center equipment, and industrial machinery.
Can customers delete their data under the new rules?
Yes, the rules state that customers should be able to delete their data from a device and move it off the product.
