Cyber Resilience Act: what it asks of the connected products you sell, and from when

The Cyber Resilience Act, often shortened to CRA, is Regulation (EU) 2024/2847Regulation (EU) 2024/2847, Cyber Resilience ActThe whole regulationClick opens the law on the EU Publications Office.. It was adopted on 23 October 2024 and has been in force since 10 December 2024 (Art. 71(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 71, paragraph 1Click opens the article on EUR-Lex.). It works like the other CE marking laws: requirements for the product, proof in a file, and the mark on the product. This time the subject is cybersecurity.

Which products the CRA covers

The CRA covers “products with digital elements”: a software or hardware product, its remote data processing, and software or hardware components sold separately (Art. 3(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 1Click opens the article on EUR-Lex.). It reaches them when their intended purpose or reasonably foreseeable use includes a direct or indirect, logical or physical data connection to a device or network (Art. 2(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 1Click opens the article on EUR-Lex.). A physical connection can run through electrical, optical or mechanical interfaces, wires or radio waves (Art. 3(9)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 9Click opens the article on EUR-Lex.).

Examples: a smart plug, a fitness band, a wireless keyboard, a network printer, a phone app, a computer program. The Commission’s guidance adds three readings that decide the hard cases:

• A data connection means data. Electrical signals that only trigger or power a function, with no digitally encoded information passing, are not a data connection. Such a product is outside.
• The device and its app are one product. Where a device needs the manufacturer’s own app or driver to do its job, the two together are the product, even when the app comes from an app store. The Commission’s example is a fitness wearable and its phone app.
• Software you install is a product; a website is not. An app or program that runs on the user’s device is in scope. A web application used only in a browser, and a website that only shows information, are not products on their own. They count only as the remote data processing of a product that needs them to work (Art. 3(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 2Click opens the article on EUR-Lex.).

Those three readings are from the Commission guidance on the CRA, sections 2.5, 2.4 and 2.2. The Commission approved its content on 27 July 2026; it becomes formal, and applies, once every language version is ready (C(2026) 5252). Guidance is not law; the Regulation’s text is.

What is outside the CRA

The CRA does not apply to:

• medical devices and in vitro diagnostic medical devices under Regulations (EU) 2017/745 and 2017/746 (Art. 2(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 2Click opens the article on EUR-Lex.);
• motor vehicles and their systems under the type-approval Regulation (EU) 2019/2144 (Art. 2(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 2Click opens the article on EUR-Lex.);
• products certified under the civil aviation Regulation (EU) 2018/1139 (Art. 2(3)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 3Click opens the article on EUR-Lex.), and marine equipment under Directive 2014/90/EU (Art. 2(4)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 4Click opens the article on EUR-Lex.);
• products within the scope of Regulation (EU) No 168/2013: two- and three-wheel vehicles and quadricycles, such as mopeds and motorcycles, and the systems, components and separate technical units designed for them, except L1e vehicles designed to pedal (Delegated Regulation (EU) 2025/1535, Art. 1; Regulation (EU) No 168/2013, Art. 2(1));
• spare parts that replace identical components and are made to the same specifications (Art. 2(6)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 6Click opens the article on EUR-Lex.);
• products developed or modified only for national security or defence, or designed to process classified information (Art. 2(7)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 7Click opens the article on EUR-Lex.);
• units placed on the EU market before 11 December 2027, until someone substantially modifies them (Art. 69(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 69, paragraph 2Click opens the article on EUR-Lex.), except for the manufacturer’s reporting duty, which reaches them too (Art. 69(3)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 69, paragraph 3Click opens the article on EUR-Lex.).

Two uses are allowed without compliance. A non-compliant product may be shown at a trade fair or demonstration with a visible sign saying it does not comply and is not for sale (Art. 4(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 4, paragraph 2Click opens the article on EUR-Lex.). Unfinished software may be made available for a limited testing period with the same kind of sign (Art. 4(3)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 4, paragraph 3Click opens the article on EUR-Lex.).

Free and open-source software is outside when it is not supplied in the course of a commercial activity; the Commission’s guidance, section 3, sets out when charging, monetising or support turns it into a commercial supply. A legal person other than the manufacturer that supports such software on a sustained basis, an “open-source software steward”, has only the light duties of Art. 24Regulation (EU) 2024/2847, Cyber Resilience ActArticle 24Click opens the article on EUR-Lex. (Art. 3(14)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 14Click opens the article on EUR-Lex.).

When each date applies

The dates are in Art. 71(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 71, paragraph 2Click opens the article on EUR-Lex., with Art. 69(3)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 69, paragraph 3Click opens the article on EUR-Lex. for the reporting duty on older products and Art. 69(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 69, paragraph 1Click opens the article on EUR-Lex. for the certificates. EU countries were told to aim for enough notified bodies by 11 December 2026 (Art. 35(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 35, paragraph 2Click opens the article on EUR-Lex.).

“Placed on the market” means the first time a product is made available in the EU (Art. 3(21)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 21Click opens the article on EUR-Lex.), and it is counted unit by unit. The Commission’s guidance (section 2.1, point 11) repeats the rule of the Blue Guide on EU product rules: placing on the market refers “to each individual product, not to a type of product”. So stock your importer brought in and supplied before 11 December 2027 can be sold after it; a new shipment of the same model supplied after it must comply. Standalone software is read differently (section 2.1, points 13 to 15): all copies of one version count as placed on the market when that version is first offered for distribution or use in the EU, whenever each copy is bought. A new version counts as newly placed only if it is a substantial modification. For a model designed before the CRA, the guidance (section 2.7) says a redesign is not always needed. The manufacturer still runs the risk assessment, draws up the declaration and affixes the CE marking.

Which role you hold

• Manufacturer: develops or manufactures a product, or has it designed, developed or made, and markets it under its own name or trademark, for payment, monetisation or free of charge (Art. 3(13)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 13Click opens the article on EUR-Lex.).
• Importer: established in the EU, places on the market a product bearing the name or trademark of someone established outside the EU (Art. 3(16)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 16Click opens the article on EUR-Lex.).
• Distributor: anyone else in the supply chain who makes the product available in the EU without affecting its properties (Art. 3(17)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 17Click opens the article on EUR-Lex.). A marketplace seller reselling branded goods is usually here.
• Authorised representative: established in the EU, acts for the manufacturer on tasks set in a written mandate (Art. 3(15)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 15Click opens the article on EUR-Lex.).

An importer or distributor that sells under its own name or trademark, or substantially modifies a product already on the market, becomes its manufacturer (Art. 21Regulation (EU) 2024/2847, Cyber Resilience ActArticle 21Click opens the article on EUR-Lex.). Anyone else who substantially modifies a product and sells it becomes the manufacturer for the part that changed, or for the whole product if the change affects its cybersecurity as a whole (Art. 22Regulation (EU) 2024/2847, Cyber Resilience ActArticle 22Click opens the article on EUR-Lex.). A substantial modification is a change after the product was placed on the market that affects its compliance with the essential cybersecurity requirements of Annex I, Part I, or changes the intended purpose it was assessed for (Art. 3(30)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 30Click opens the article on EUR-Lex.).

How it reaches a business outside the EU

The CRA governs products made available on the EU market (Art. 2(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 2, paragraph 1Click opens the article on EUR-Lex., Art. 3(22)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 3, point 22Click opens the article on EUR-Lex.). It does not govern sales outside the EU. It reaches a UK, US or Chinese business the moment that business sells into the EU.

In Northern Ireland only the CRA’s amendments to Regulation (EU) 2019/1020Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office. and Regulation (EU) No 168/2013 apply (Art. 66Regulation (EU) 2024/2847, Cyber Resilience ActArticle 66Click opens the article on EUR-Lex., Art. 68Regulation (EU) 2024/2847, Cyber Resilience ActArticle 68Click opens the article on EUR-Lex.). Its other rules apply there only once the EU-UK Joint Committee adds them to Annex 2 of the Windsor Framework (UK explanatory memorandum of 5 May 2026, points 1, 2, 4 and 18). No official source shows that decision taken as of 6 October 2026; on 7 May 2026 the two sides finished their exchange of views and put it to the next Joint Committee meeting (joint statement of 7 May 2026).

A business outside the EU that sells under its own brand is the manufacturer and carries every manufacturer duty, wherever it sits. The CRA itself does not force it to appoint anyone in the EU: the manufacturer “may” appoint an authorised representative (Art. 18(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 18, paragraph 1Click opens the article on EUR-Lex.). Most connected hardware, though, is also radio or electrical equipment. For products under the radio, low-voltage, electromagnetic compatibility and RoHS Directives, an economic operator established in the EU must be responsible for the product before it is placed on the market (Art. 4(1)Regulation (EU) 2019/1020, Market Surveillance RegulationArticle 4, paragraph 1Click opens the article on EUR-Lex., Art. 4(5)Regulation (EU) 2019/1020, Market Surveillance RegulationArticle 4, paragraph 5Click opens the article on EUR-Lex. of Regulation (EU) 2019/1020Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office.). A connected consumer product that no other EU product law with specific safety requirements covers needs one under the General Product Safety Regulation (EU) 2023/988 (Art. 16(1)Regulation (EU) 2023/988, General Product Safety RegulationArticle 16, paragraph 1Click opens the article on EUR-Lex.). The CRA applies that part of GPSR to such products for their risks other than cybersecurity (Art. 11Regulation (EU) 2024/2847, Cyber Resilience ActArticle 11Click opens the article on EUR-Lex.). Who can hold that role is the EU Responsible Person.

A manufacturer with no main establishment in the EU still reports through the single platform. Its report goes to the national team of the first EU country in this order: where the authorised representative acting for most of its products is established; failing that, where the importer placing most of its products is; failing that, where the distributor making most of its products available is; failing that, where most of its users are (Art. 14(7)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 14, paragraph 7Click opens the article on EUR-Lex.).

What each role owes

In short: the manufacturer builds the security in and keeps it up; the importer makes sure the proof exists before the product enters the EU; the distributor checks what is visible and what it was given.

What the product must meet

Annex I, Part I sets the requirements for the product itself. Where the risk assessment makes them applicable, the product must (Art. 6Regulation (EU) 2024/2847, Cyber Resilience ActArticle 6Click opens the article on EUR-Lex., Annex I, Part I, point 2):

• go on sale with no known exploitable vulnerabilities;
• be secure by default, with a way to reset it to its original state;
• take security updates, automatic by default where applicable, with an easy way to opt out;
• protect against unauthorised access, through authentication and access control;
• protect the confidentiality of the data it stores or sends, for example by encryption;
• protect the integrity of its data, commands, programs and settings;
• process only the data it needs for its purpose;
• keep its essential functions available, also after an incident, including against denial-of-service attacks;
• not disrupt other devices or networks;
• keep its attack surface small, external interfaces included;
• limit the damage an incident can do;
• record relevant internal activity, with an opt-out for the user;
• let the user remove all data and settings securely and permanently.

Annex I, Part II sets what the manufacturer does, for the whole support period: list the components in a software bill of materials, at least the top-level dependencies; fix vulnerabilities without delay, with security updates separate from feature updates where feasible; test the product regularly; publish information on fixed vulnerabilities; run a coordinated vulnerability disclosure policy; give a contact address for reporting vulnerabilities; distribute updates securely; and provide security updates free of charge, with advice to users on what to do.

The technical documentation holds the evidence: a description of the product and its design, the vulnerability handling process with the software bill of materials, the risk assessment, the reasons for the support period chosen, the standards applied, test reports and the declaration (Art. 31Regulation (EU) 2024/2847, Cyber Resilience ActArticle 31Click opens the article on EUR-Lex., Annex VII). Micro and small enterprises may use a simplified form the Commission sets by implementing act (Art. 33(5)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 33, paragraph 5Click opens the article on EUR-Lex.).

Which products need a notified body

The default route is internal control, module A: the manufacturer assesses its own product and signs the declaration, with no outside body (Art. 32(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 32, paragraph 1Click opens the article on EUR-Lex., Annex VIII, Part I).

Two lists change that. Annex III names “important” products, in two classes. Annex IV names “critical” ones. A product is on a list when its core functionality is a listed category; a listed component built into another product does not, on its own, put that product on the list (Art. 7(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 7, paragraph 1Click opens the article on EUR-Lex.).

The routes are in Art. 32(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 32, paragraph 2Click opens the article on EUR-Lex., Art. 32(3)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 32, paragraph 3Click opens the article on EUR-Lex., Art. 32(4)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 32, paragraph 4Click opens the article on EUR-Lex. and Art. 8(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 8, paragraph 1Click opens the article on EUR-Lex.. The wearable, toy, smart home and router descriptions are those of Implementing Regulation (EU) 2025/2392, Annex I, which fixes the technical description of every category (its Art. 2); the payment terminal example is in its Annex II. Conformity assessment fees must be reduced in proportion for micro, small and medium-sized enterprises (Art. 32(6)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 32, paragraph 6Click opens the article on EUR-Lex.).

Electronic health record (EHR) systems follow their own route. Their manufacturers prove conformity with Annex I through the conformity assessment procedure in Chapter III of the European Health Data Space Regulation (Art. 32(5a)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 32, paragraph 5aClick opens the article on EUR-Lex., inserted by Art. 104 of Regulation (EU) 2025/327).

What goes on the product, in the box and on the listing

• The CE marking, visible, legible and indelible, on the product. Where that is not possible or warranted, on the packaging and on the declaration. For software, on the declaration or on the website that accompanies it. It may be smaller than 5 mm if it stays legible, and goes on before the product is placed on the market (Art. 30(1)-(3)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 30, paragraphs 1 to 3Click opens the article on EUR-Lex.). A notified body’s number follows it only after full quality assurance, module H (Art. 30(4)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 30, paragraph 4Click opens the article on EUR-Lex.). How the mark is drawn across all product laws is CE marking.
• An identification number: type, batch or serial number, or another element that identifies the product (Art. 13(15)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 13, paragraph 15Click opens the article on EUR-Lex.).
• Who made it: the manufacturer’s name, registered trade name or trademark, postal address, and email or other digital contact, plus the website where there is one (Art. 13(16)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 13, paragraph 16Click opens the article on EUR-Lex.). The importer adds the same about itself (Art. 19(4)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 19, paragraph 4Click opens the article on EUR-Lex.).
• The user information of Annex II, on paper or electronically, in a language users understand (Art. 13(18)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 13, paragraph 18Click opens the article on EUR-Lex.). It names the manufacturer and the single point of contact for reporting vulnerabilities; identifies the product; states its intended purpose, security properties and known risks; gives the web address of the declaration; states the type of security support and the support period’s end date; and explains secure set-up, installing updates, turning off automatic updates, and deleting user data at the end.
• The declaration: a copy of the EU declaration of conformity, or the simplified one, which reads “Hereby, [manufacturer] declares that the product with digital elements type [type] is in compliance with Regulation (EU) 2024/2847Regulation (EU) 2024/2847, Cyber Resilience ActThe whole regulationClick opens the law on the EU Publications Office.” and gives the web address of the full text (Art. 13(20)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 13, paragraph 20Click opens the article on EUR-Lex., Annex VI). Where the product falls under several EU laws that require a declaration, one declaration names them all (Art. 28(3)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 28, paragraph 3Click opens the article on EUR-Lex.).
• The support period’s end date, at least month and year, shown clearly at the time of purchase and, where applicable, on the product, its packaging or by digital means (Art. 13(19)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 13, paragraph 19Click opens the article on EUR-Lex.).

What manufacturers must report, and how fast

Since 11 September 2026, a manufacturer notifies two kinds of event through the single reporting platform run by ENISA, the EU cybersecurity agency (Art. 14Regulation (EU) 2024/2847, Cyber Resilience ActArticle 14Click opens the article on EUR-Lex., Art. 16(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 16, paragraph 1Click opens the article on EUR-Lex.):

An incident is severe when it harms, or can harm, the product’s ability to protect sensitive or important data or functions, or when it has led, or can lead, to malicious code running in the product or in the user’s systems (Art. 14(5)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 14, paragraph 5Click opens the article on EUR-Lex.). The manufacturer also tells the affected users what happened and what they can do (Art. 14(8)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 14, paragraph 8Click opens the article on EUR-Lex.). The national teams give helpdesk support on reporting, in particular to micro, small and medium-sized enterprises (Art. 17(6)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 17, paragraph 6Click opens the article on EUR-Lex.).

Importers and distributors do not report to the platform. They tell the manufacturer of any vulnerability they learn of, without undue delay, and tell the market surveillance authorities at once when the product presents a significant cybersecurity risk (Art. 19(5)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 19, paragraph 5Click opens the article on EUR-Lex., Art. 20(4)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 20, paragraph 4Click opens the article on EUR-Lex.).

What radio products must meet already

Radio equipment already has a cybersecurity rule. The Radio Equipment Directive holds three requirements for categories the Commission names: network protection, personal data and privacy, and fraud protection (Art. 3(3)Directive 2014/53/EU, Radio Equipment Directive (consolidated text of 30 May 2026)Article 3, paragraph 3Click opens the article on EUR-Lex., points (d), (e) and (f)). They apply from 1 August 2025 (Delegated Regulation (EU) 2023/2444, Art. 1). Which products they cover, and the harmonised standards for them, are in Radio Equipment Directive.

The rule ends when the CRA takes over. Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027 (its Art. 1), because the CRA’s Annex I includes everything those three requirements cover (its recital 3). Radio equipment placed on the market between 1 August 2025 and 10 December 2027 can still be checked against them after that date (its recital 5).

How the CRA sits next to GPSR and other laws

The CRA covers cybersecurity only. For a connected product that no other EU safety law covers, the general product safety rules of GPSR still apply to its other risks (Art. 11Regulation (EU) 2024/2847, Cyber Resilience ActArticle 11Click opens the article on EUR-Lex.). The CRA is one of the laws under the market surveillance Regulation (EU) 2019/1020Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office. (Art. 52(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 52, paragraph 1Click opens the article on EUR-Lex., Art. 66Regulation (EU) 2024/2847, Cyber Resilience ActArticle 66Click opens the article on EUR-Lex.), so the same authorities and the same powers apply as for other CE-marked goods. Whether GPSR reaches your product at all is the page on whether GPSR applies to you.

What happens if you sell without it

A market surveillance authority with sufficient reason to consider that a product presents a significant cybersecurity risk evaluates it against the whole Regulation. Where it finds the product does not comply, it orders corrective action, withdrawal or recall within a period it sets (Art. 54(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 54, paragraph 1Click opens the article on EUR-Lex.). If the business does not act, the authority prohibits or restricts the product, withdraws it or recalls it (Art. 54(5)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 54, paragraph 5Click opens the article on EUR-Lex.), and the other EU countries take restrictive measures too (Art. 54(9)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 54, paragraph 9Click opens the article on EUR-Lex.).

Each EU country sets the penalties, and the CRA fixes their ceilings (Art. 64(1)-(4)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 64, paragraphs 1 to 4Click opens the article on EUR-Lex.):

Each fine weighs the size and market share of the business, with micro, small and medium-sized enterprises named in particular (Art. 64(5)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 64, paragraph 5Click opens the article on EUR-Lex.). A manufacturer that is a micro or small enterprise is not fined for missing the 24-hour deadline of an early warning (Art. 64(10)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 64, paragraph 10Click opens the article on EUR-Lex., point (a), as corrected by the corrigendum of 2 July 2025, which makes it cover paragraphs 2 to 9). The exemption names that deadline only. In our reading, the 72-hour notification, the final report, and not sending an early warning at all can still be fined. Consumer organisations can bring representative actions against breaches (Art. 65Regulation (EU) 2024/2847, Cyber Resilience ActArticle 65Click opens the article on EUR-Lex.).

What the law leaves open

• Harmonised standards. A product that follows a harmonised standard published in the Official Journal is presumed to meet the requirements it covers (Art. 27(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 27, paragraph 1Click opens the article on EUR-Lex.). The Commission asked the European standards bodies for 41 such standards (request M/606). Its standardisation page, last updated 31 July 2026, names none as published. Until a harmonised standard, a common specification or a European cybersecurity certification scheme at assurance level at least “substantial” exists and is applied in full, an Annex III class I product cannot use self-assessment alone (Art. 32(2)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 32, paragraph 2Click opens the article on EUR-Lex.).
• The guidance’s final form. The Commission guidance cited here is a draft whose content was approved on 27 July 2026. It applies once every language version is adopted (C(2026) 5252).
• How long a support period must be. The floor is five years, or the expected time of use where that is shorter (Art. 13(8)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 13, paragraph 8Click opens the article on EUR-Lex.). ADCO, the group of the EU countries’ market surveillance authorities, is to publish guidance with indicative support periods per category, and the Commission may set minimums by delegated act (Art. 52(16)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 52, paragraph 16Click opens the article on EUR-Lex., Art. 13(8)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 13, paragraph 8Click opens the article on EUR-Lex.).
• Certificates for critical products. Annex IV products need a European cybersecurity certificate only once the Commission requires one by delegated act; until then they follow the class II routes (Art. 8(1)Regulation (EU) 2024/2847, Cyber Resilience ActArticle 8, paragraph 1Click opens the article on EUR-Lex.).

What you can skip