Cyber Resilience Act: new European rules aim to make digital products more secure

When a company buys a network device, chooses management software or installs an Internet-connected device, it is natural to begin by considering price, features and ease of use. These are important criteria, because a technology tool only makes sense when it meets a real need and fits within the resources available.

There is, however, another consideration that is not always so easy to assess when buying: what happens to the product in the years that follow. Knowing whether it will continue to receive updates, how long support will remain available and how any security vulnerabilities will be communicated can matter just as much as the features described in the sales proposal.

To strengthen security throughout the lifetime of digital products covered by the rules, the European Union adopted the Cyber Resilience Act, known as the CRA. The regulation entered into force on 10 December 2024 and is being applied in stages. Some provisions began to take effect before the majority of its requirements, which are scheduled to apply from 11 December 2027.

Since 11 September 2026, manufacturers covered by the regulation have been subject to requirements to report certain actively exploited vulnerabilities and severe incidents affecting the security of their products. The change matters to the technology industry, but it also deserves explanation for those who use these products in their work.

Which products are covered?

The regulation applies to products with digital elements placed on the European Union market. Within its legal scope, it covers software and equipment capable of communicating with other devices or networks.

Examples that help illustrate the type of technology involved include certain network devices, connected devices and software products sold for use by companies or individuals. Whether a particular product is covered depends on its characteristics, how it is supplied and the exclusions set out in the law. It would therefore be wrong to assume that every digital service is automatically within scope.

The central idea is that security should not be considered only when a product is developed and put on sale. Vulnerabilities may be found over time, new forms of attack may emerge or components that no longer receive support may need replacing, and there must be ways to deal with these situations.

The CRA sets out requirements intended to reinforce this responsibility throughout the lifecycle of covered products, including how manufacturers assess risks, handle vulnerabilities and provide information to users.

What changed in September 2026?

One of the first measures to become applicable concerns reporting particularly significant security problems. Since 11 September, manufacturers covered by the regulation have been required to report vulnerabilities in their products that they know are being actively exploited, as well as severe incidents affecting those products’ security, under the conditions laid down by the regulation.

Reports are made through a European platform established for this purpose. Deadlines include an initial warning within 24 hours of the manufacturer becoming aware of the situation and a fuller notification within 72 hours, followed by any applicable final reports.

For someone running a small business, these procedures may seem distant from day-to-day operations, but they address an important question: when a significant flaw is discovered in a product used by many organisations, the relevant authorities need to receive that information and the situation needs to be followed up in a structured way.

This does not mean every software problem will be disclosed publicly in the same way, nor that a product automatically becomes secure simply because the regulation applies to it. The obligations have specific conditions and do not replace the need for users to follow manufacturers’ recommendations and the guidance of their service providers.

What changes for a small company buying technology?

For most small companies that simply buy and use equipment or software, the CRA does not mean taking on the same legal obligations as a manufacturer. The regulation distinguishes between different market participants, including manufacturers, importers and distributors, and responsibilities depend on the role each organisation plays.

Even so, the new legislation reinforces the importance of factors that should already be part of an informed purchasing decision. Before choosing a technology solution, it makes sense to ask how long security updates will be provided, how the end of support will be communicated and who will be responsible for installing necessary fixes.

Imagine, for example, a small business deciding to install connected devices to manage access to its premises. It is natural to compare functions, ease of use and installation costs, but it is also important to understand what happens if a vulnerability is discovered in the equipment or if the manufacturer stops providing updates. The answer may affect not just security but also service continuity and the cost of replacing the equipment later.

The same reasoning applies to a network device used in an office or to a software solution on which important business processes depend. A lower initial price may be a good choice, but it can only be evaluated properly when the support period, maintenance costs and medium-term operating conditions are understood.

Four questions worth asking before buying

The first is how long the product will receive support and security updates, because the length of that commitment helps determine whether the solution is suitable for the period during which the company expects to use it.

The second is how vulnerabilities and available fixes will be communicated. A supplier that provides clear information makes life easier for whoever needs to keep systems updated.

The third is who takes responsibility for each task after installation, particularly monitoring alerts, applying updates and resolving problems. Those tasks do not always fall to the same organisation, especially when purchasing, installation and maintenance are handled by different suppliers.

Finally, it is important to understand what happens when the product reaches the end of its support period or no longer meets the company’s needs, so its replacement can be planned rather than triggered by an emergency.

These questions do not require in-depth legal or technical knowledge, but they help businesses compare proposals more comprehensively and avoid decisions based solely on purchase price.

Security does not mean the absence of vulnerabilities

The application of the Cyber Resilience Act does not mean vulnerabilities in software or equipment will cease to exist. Likewise, meeting security requirements does not, in itself, eliminate every risk associated with using technology.

What the regulation seeks to do is establish a more demanding baseline for the development, sale and ongoing support of covered products, making the obligations of those placing them on the market clearer. For businesses using those products, the change is also an opportunity to place greater weight on maintenance and support when choosing technology solutions.

The purchase of a digital product does not end when the device is switched on or the application starts working. From that point onwards, there is a period during which updates need to be ensured, changes monitored and, eventually, replacement planned.

Understanding that lifecycle makes it possible to take more informed decisions and reduces the likelihood of discovering too late that an important tool is no longer receiving the attention it needs.

Do you know how long your company’s equipment and software will receive updates?

At TISEC, we help businesses assess technology solutions, understand maintenance responsibilities and identify risks associated with the systems on which they depend, seeking to align technical decisions with business needs.

If you are considering buying new equipment or want to review the technology you already use, we can discuss the security and continuity considerations worth taking into account before deciding.

Official sources: European Commission — The Cyber Resilience Act: Summary of the legislative text; European Commission — Cyber Resilience Act: Reporting obligations

Precision note: the CRA does not automatically impose manufacturers’ obligations on a business that merely uses a product. Some obligations began applying in 2026, while the main requirements will apply from 11 December 2027. The legal position always depends on the product and the organisation’s role in the supply chain.