EU Cyber Resilience Act (Regulation (EU) 2024/2847): cybersecurity requirements for products with digital elements
Manufacturers of hardware and software products sold in the EU must design them to horizontal cybersecurity requirements, handle vulnerabilities and supply security updates over a support period, and, since 11 September 2026, report actively exploited vulnerabilities and severe incidents through a single platform run by ENISA. Products judged important or critical face stricter conformity assessment, up to third-party assessment by a notified body.
Scope. Reaches a US manufacturer that places hardware or software with digital elements on the EU market: Article 19 lets its EU importer place only compliant products, and Article 14(7) fixes the reporting endpoint for a manufacturer with no EU establishment. Article 2(2)-(4) excludes products covered by the medical device rules (2017/745, 2017/746), motor vehicle type-approval (2019/2144), aviation certification (2018/1139) and marine equipment (2014/90/EU).
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Reporting integrity C-V2 | Required by the text | Article 14(1) and (3): a manufacturer 'shall notify any actively exploited vulnerability' and 'any severe incident having an impact on the security of the product' simultaneously to the coordinating CSIRT and ENISA via the single reporting platform; Article 14(2) and (4): early warning 'within 24 hours', notification 'within 72 hours', final report within 14 days of a fix (vulnerabilities) or one month (incidents). Applies from 11 September 2026 (Article 71(2)). | high | 1 case |
| Coordinated disclosure program C-O1 | Required by the text | Annex I Part II: manufacturers shall '(5) put in place and enforce a policy on coordinated vulnerability disclosure' and '(6) ... provid[e] a contact address for the reporting of the vulnerabilities'; Article 13(8): manufacturers 'shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies'; Article 13(17): a single point of contact 'to facilitate reporting on vulnerabilities'. Applies from 11 December 2027. | high | not yet seen missing in a case |
| Organizational recovery process C-R4 | Required by the text | Article 13(21): a manufacturer that knows a product or its processes do not conform 'shall immediately take the corrective measures necessary ... or to withdraw or recall the product'; Article 13(8): vulnerabilities handled for a support period of 'at least five years'; Annex I Part II (2) remediate 'without delay, including by providing security updates' and (8) disseminate updates without delay with advisory messages; Article 14(8): inform impacted users. Applies from 11 December 2027 (Article 14(8) from 11 September 2026). | high | 1 case |
| Actor identity verification C-A1 | Implied | Annex I Part I (2)(d): products shall 'ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access'. Applies where the risk assessment requires it (Part I(2) 'where applicable'); from 11 December 2027. | high | 8 cases |
| Provenance of the actor's software and hardware C-A3 | Implied | Annex I Part II (1): 'identify and document vulnerabilities and components ... including by drawing up a software bill of materials'; Article 13(5): 'exercise due diligence when integrating components sourced from third parties'. Documents component origin; does not address parties able to compel access. From 11 December 2027. | high | 1 case |
| Independent audit log C-V1 | Implied | Annex I Part I (2)(l): 'provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user'. No requirement that the record be beyond the product's reach. From 11 December 2027. | medium | 1 case |
| Independent assurance before deployment C-O2 | Implied | Article 32(3)-(4): important products of class II (Annex III) and critical products (Annex IV) must use EU-type examination (module B+C), full quality assurance (module H) or a European cybersecurity certification scheme, all involving a third party; Article 32(2) the same for class I where harmonised standards are not applied. Limited to listed product categories; from 11 December 2027. | medium | 1 case |
Cases that cite this rule
| Case | How the case cites it | Outcome |
|---|---|---|
| Benavides v. Tesla 2025 | NHTSA Standing General Order (post-2021 reporting; not applicable to the 2019 crash) | Ended in harm |