The EU Cyber Resilience Act, what product makers need to do

Design, develop and produce the product so it has an appropriate level of cybersecurity based on the risks.

Make the product available without known exploitable vulnerabilities.

Ship with a secure-by-default configuration, including the ability to reset the product to its original state.

Let vulnerabilities be fixed through security updates, with automatic updates on by default where applicable, a clear opt-out, notification of available updates and the option to postpone them temporarily.

Protect against unauthorised access with suitable controls such as authentication and identity or access management, and report on possible unauthorised access.

Protect the confidentiality of stored, transmitted or otherwise processed data, for example by encrypting relevant data at rest or in transit with state-of-the-art mechanisms.

Protect the integrity of data, commands, programs and configuration against unauthorised changes, and report on corruption.

Process only data that is adequate, relevant and limited to what is necessary for the product's purpose (data minimisation).

Let users securely and easily remove all data and settings permanently, and transfer data securely where it can be moved to other products.

Protect the availability of essential and basic functions, including after an incident and through resilience and mitigation against denial-of-service attacks.

Minimise the negative impact of the product or connected devices on the availability of services provided by other devices or networks.

Limit attack surfaces, including external interfaces.

Reduce the impact of an incident through suitable exploitation mitigation mechanisms and techniques.

Provide security-related information by recording and monitoring relevant internal activity such as access to or changes of data, services or functions, with an opt-out for the user.

Identify and document vulnerabilities and components, including a software bill of materials in a commonly used machine-readable format covering at least top-level dependencies.

Address and remediate vulnerabilities without delay by providing security updates, and where technically feasible ship security updates separately from feature updates.

Apply effective and regular tests and reviews of product security.

Once a fix is available, share and publicly disclose information on fixed vulnerabilities, including a description, affected products, impact, severity and clear help for users to remediate.

Put in place and enforce a coordinated vulnerability disclosure policy.

Facilitate sharing of information on potential vulnerabilities in the product and in third-party components, including a contact address for reports.

Provide mechanisms to distribute updates securely, and automatically where applicable for security updates.

Disseminate security updates without delay and, unless agreed otherwise for a tailor-made product, free of charge, with advisory messages explaining what users can do.

Make sure the product is designed, developed and produced to meet Annex I Part I, and assess the cybersecurity risks and use the outcome during planning, design, development, production, delivery and maintenance.

Document and update the risk assessment during the support period, say whether and how each Annex I requirement applies, include it in the technical documentation and justify any requirement that does not apply.

Exercise due diligence when using third-party components, including open-source ones, report vulnerabilities found in a component to its maintainer and share fixes where appropriate.

Document relevant cybersecurity aspects of the product in proportion to the risks, including vulnerabilities you learn of, and update the risk assessment where applicable.

Handle vulnerabilities for a support period that reflects how long the product is expected to be used and is at least five years, or the expected use time if shorter, and record how you decided it in the technical documentation.

Keep each security update available for at least 10 years after it is issued or for the rest of the support period, whichever is longer.

Before placing the product on the market, draw up the technical documentation, carry out the conformity assessment, issue the EU declaration of conformity and affix the CE marking, and keep the documentation and declaration for at least 10 years or the support period, whichever is longer.

Keep series production in conformity as design, process or standards change, and give each product a type, batch or serial identifier.

Show the manufacturer's contact details and a single point of contact for users, including for vulnerability reports, and provide the Annex II information and instructions with the product.

Notify any actively exploited vulnerability in your product at the same time to the national CSIRT acting as coordinator and to ENISA, through the single reporting platform: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours and a final report no later than 14 days after a fix or mitigation is available.

Notify any severe incident affecting product security the same way: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month after the 72 hour notification, where severe means it harms or could harm the protection of important data or functions, or leads to malicious code.

Provide intermediate reports when the receiving CSIRT asks, and submit notifications to the CSIRT of the Member State of your main establishment through the platform endpoint.

Apply these duties to all products already on the EU market, not only new ones, from 11 September 2026.

Check whether the product falls in the important (class I or II) or critical product categories, which decides which conformity route you may use.

Choose and carry out the conformity assessment: usually internal control (self-assessment), but third-party assessment by a notified body or a cybersecurity certification scheme where your category requires it.

Draw up technical documentation with the minimum content in Annex VII and keep it available for market surveillance authorities.

Draw up the EU declaration of conformity (or a simplified version) once conformity is shown.

Affix the CE marking to show the product meets the Act.

Importers check that the manufacturer has met the essential requirements, has vulnerability handling in place, has carried out conformity assessment, drawn up the technical documentation and marked the product with CE, and do not place non-compliant products on the market.

Distributors verify the CE marking, the manufacturer and importer details, the instructions and the stated support period before making the product available, and do not supply products they believe are non-compliant.

Open-source software stewards that support products intended for commercial use have a cybersecurity policy, cooperate with market surveillance authorities and report actively exploited vulnerabilities and severe incidents where involved.

Know the fine ceilings: up to EUR 15 million or 2.5 per cent of worldwide turnover for breaking Annex I or Articles 13 and 14, and up to EUR 10 million or 2 per cent for certain other duties, whichever is higher for an undertaking.