Cyber Resilience Act: what manufacturers of digital products need to know

Who is covered

Hardware and software products whose use includes a direct or indirect data connection to a device or network: connected household and industrial devices, routers, controllers, firmware and software sold as a product. Areas with their own rules are excluded, such as medical devices, motor vehicles and civil aviation.

Manufacturer obligations

Cybersecurity from the design stage, vulnerability handling including an SBOM and free security updates, a support period of generally at least five years, reports via ENISA's platform, technical documentation, an EU declaration of conformity and CE marking.

Important and critical products

For most products the manufacturer's internal control is sufficient. Certain important or critical products – such as routers, firewalls or secure elements – require stricter procedures, partly with a notified body.