The Cyber Resilience Act: Why Europe Is Changing the Rules for Connected Devices
A smart camera protects your home, a router connects your devices and a smartwatch tracks your daily activity. These products have become essential parts of everyday life, yet their security often depends on something users rarely see: software updates, vulnerability management and the manufacturer’s willingness to maintain protection long after a product has been sold.
The European Union’s Cyber Resilience Act aims to change how connected hardware and software are designed, secured and maintained. Rather than leaving cybersecurity largely to individual manufacturers’ commercial decisions, the regulation establishes common requirements for products with digital elements sold in the European market.
The changes are already beginning. Since 11 September 2026, manufacturers have been required to report certain actively exploited vulnerabilities and severe security incidents. Broader cybersecurity requirements will follow in December 2027. For consumers and technology companies alike, the new framework raises an important question: could security finally become a fundamental characteristic of the products we buy, rather than an optional feature?
What Is the Cyber Resilience Act?
The Cyber Resilience Act (CRA) is a European Union regulation establishing cybersecurity requirements for hardware and software products with digital elements.
Formally known as Regulation (EU) 2024/2847, it introduces rules covering product design, development, security maintenance, vulnerability management and compliance.
Its purpose is to address two persistent problems in the technology market.
The first is that digital products do not always provide an adequate level of cybersecurity. Some reach consumers with unnecessary vulnerabilities, insecure configurations or insufficient protection against common attacks.
The second concerns what happens after purchase.
A product may continue operating for years while the manufacturer stops providing the updates necessary to address newly discovered security weaknesses.
The CRA attempts to address both problems through requirements extending beyond the moment a product enters the market.
Manufacturers are expected to consider cybersecurity throughout the product lifecycle, assess relevant risks and establish processes for addressing vulnerabilities during an appropriate support period.
According to the European Commission’s official overview, the legislation is designed to improve the security of hardware and software products while helping consumers make better-informed purchasing decisions.
This is an important distinction.
The CRA is not simply another collection of cybersecurity recommendations.
It establishes legally binding requirements, with different provisions becoming applicable at different stages of its implementation.
Why Connected Devices Need Stronger Security Standards
Modern electronic devices are rarely isolated systems.
A smart television may connect to streaming platforms, cloud accounts and other household devices.
An IP camera can send video to a smartphone, while a router manages traffic between computers, phones, connected appliances and the Internet.
Even devices with relatively simple functions may communicate with remote services to receive updates, synchronize information or provide additional features.
Every connection can introduce dependencies and potential security risks.
An outdated software component may contain a vulnerability that allows unauthorized access. An insecure authentication system may expose user accounts, while a poorly protected remote interface can create opportunities for attackers.
The consequences depend on the affected product.
A compromised home camera may threaten privacy. A vulnerable router can become a point of entry into a network. Security weaknesses in business software may expose important information or disrupt operations.
However, cybersecurity risks are not limited to deliberate attacks against a particular user.
Vulnerable connected devices can also be targeted by automated attacks that search the Internet for exposed systems.
This creates a challenge for consumers.
Someone buying a camera or router may compare resolution, wireless standards, price and compatibility, yet have little information about how long the product will receive security updates.
The manufacturer may advertise convenient features without clearly communicating its vulnerability-handling policy.
The CRA seeks to make cybersecurity a more consistent part of product development and maintenance.
Rather than expecting users to compensate for every design weakness, the regulation places responsibilities on the economic operators bringing covered products to the European market.
Which Devices and Software Are Covered?
The Cyber Resilience Act applies broadly to products with digital elements made available on the EU market when their intended or reasonably foreseeable use includes a direct or indirect connection to another device or network.
That definition extends beyond traditional computer equipment.
Products potentially covered by the regulation include smartphones, connected cameras, routers, smartwatches, smart home equipment, operating systems and many software applications.
The rules can also apply to hardware and software components placed separately on the market.
For example, a software component supplied commercially for integration into another product can form part of the broader regulatory framework.
The scope also addresses certain remote data-processing capabilities when those services are necessary for the functioning of the relevant product and meet the regulation’s definition.
This reflects how contemporary technology operates.
A connected device may depend on software installed locally, firmware maintained by its manufacturer and remote infrastructure supporting essential functions.
Assessing the security of only the physical hardware would therefore provide an incomplete picture.
Nevertheless, not every electronic product or digital service automatically falls within the CRA.
Certain products are excluded because they are covered by other EU frameworks, including relevant categories of medical devices and vehicles.
Other exclusions and special provisions depend on the nature of the product, its intended purpose and the applicable regulatory framework.
The European Commission provides a more detailed explanation in its summary of the CRA’s scope and obligations.
The central principle is that products incorporating connected digital functionality must be assessed according to the risks they introduce, rather than treating cybersecurity as an issue relevant only to conventional computers.
What Changed on 11 September 2026?
The most significant recent development concerns mandatory cybersecurity reporting.
On 11 September 2026, manufacturers became subject to obligations requiring them to report two specific categories of security events affecting covered products.
The first involves vulnerabilities that are being actively exploited.
These are security weaknesses for which there is reliable evidence that a malicious actor has exploited the vulnerability without authorization.
The second involves severe incidents affecting the security of a product with digital elements.
Such incidents can involve serious consequences for the confidentiality, integrity, authenticity or availability of information and functions.
The distinction matters because the reporting obligations do not mean that every software defect or theoretical vulnerability must automatically be reported through the same mandatory process.
The regulation targets particular events meeting defined criteria.
Manufacturers are required to provide an early warning without undue delay and, in any event, within 24 hours of becoming aware of a reportable event.
A more detailed notification must follow within 72 hours.
The applicable final-report deadline then depends on the type of event.
For actively exploited vulnerabilities, the final report must be submitted no later than 14 days after a corrective or mitigating measure becomes available.
For severe incidents, it must be submitted within one month following the 72-hour notification.
These deadlines create a coordinated framework for responding to serious cybersecurity problems.
They do not guarantee that every vulnerability will be fixed within 24 or 72 hours.
Those time limits concern reporting, not the completion of technical remediation.
The European Commission’s reporting guidance explains the notification requirements and their implementation.
ENISA’s Single Reporting Platform Is Now Operational
The September 2026 deadline also marked the launch of an important technical infrastructure.
The European Union Agency for Cybersecurity, ENISA, announced the deployment of the initial operating capability of the CRA Single Reporting Platform on 11 September 2026.
The platform is intended to simplify the reporting process for manufacturers.
Instead of requiring separate submissions to multiple national authorities for the same event, the system supports reporting through a single European mechanism.
Information is made available to ENISA and the relevant national Computer Security Incident Response Teams, commonly known as CSIRTs.
The appropriate national authorities can then coordinate the handling and dissemination of information within the regulatory framework.
This is particularly relevant for technology products sold across multiple EU countries.
A vulnerability affecting a widely distributed router, for example, may have consequences for users in several Member States.
A coordinated reporting mechanism can help the responsible authorities develop a more consistent picture of the risk.
The system also incorporates safeguards intended to protect sensitive information submitted during the reporting process.
That protection matters because premature or uncontrolled disclosure of technical vulnerability details can introduce additional security risks.
In its updated guidance of 3 October 2026, ENISA clarified practical aspects of the platform, including registration, reporting responsibilities and notification deadlines.
This confirms that the CRA is moving beyond legislation into operational cybersecurity infrastructure.
Security by Design: What Manufacturers Will Be Expected to Do
The broader CRA requirements are built around the principle commonly described as security by design.
Instead of treating cybersecurity as an additional feature introduced after a product is finished, manufacturers must incorporate appropriate security measures into development and production.
This begins with risk assessment.
A company needs to consider how its product will be used, what threats it may face and which measures are appropriate to reduce foreseeable cybersecurity risks.
The regulation’s essential requirements address areas such as secure configurations, access control, protection against unauthorized access and vulnerability management.
They also cover measures intended to reduce unnecessary exposure to attacks.
For connected devices, this can have several practical implications.
A manufacturer may need to reconsider insecure default configurations, improve authentication mechanisms or design a more reliable process for delivering security updates.
Software developers must also account for the security of external components incorporated into their products.
That matters because contemporary applications and devices frequently rely on third-party libraries, software packages and other components.
A vulnerability in one component can affect many products that depend on it.
The CRA therefore places importance on managing these dependencies as part of a product’s overall cybersecurity risk.
However, the regulation does not prescribe one identical technical solution for every product.
Security measures must be assessed in relation to the product’s risks, purpose and applicable requirements.
A smart light bulb and an industrial network component do not necessarily require the same technical controls.
What matters is that cybersecurity becomes a documented responsibility of the manufacturer rather than an informal consideration.
Security Updates Could Become a More Important Part of Product Ownership
One of the most consequential aspects of the Cyber Resilience Act concerns the length of time manufacturers must address vulnerabilities.
Under the CRA’s general framework, manufacturers will need to determine a security support period reflecting the length of time a covered product is reasonably expected to be used.
The regulation generally establishes a minimum support period of five years.
However, this is not an unconditional rule that every product must receive exactly five years of support.
Where a product is reasonably expected to be used for less than five years, the support period may correspond to that shorter expected lifetime.
Conversely, a product expected to remain in use for longer than five years may require a longer support period.
The distinction is especially relevant to devices such as routers and other network equipment, which may remain operational for many years.
A device can continue performing its original function while its software becomes increasingly vulnerable to newly discovered security weaknesses.
That creates a mismatch between physical usability and digital safety.
The CRA seeks to address this problem by connecting vulnerability management to the expected useful life of the product.
It also requires manufacturers, once the relevant provisions apply, to make information about the support period available to users.
The end date of the support period must be specified clearly and understandably, including the month and year.
This could make an important difference when comparing products.
A consumer choosing between two connected cameras may eventually be able to consider the promised security support period alongside image quality, storage features and price.
The implications go beyond convenience.
A longer, credible security support period may reduce the risk of a functional device becoming unnecessarily difficult to use safely.
However, security support does not necessarily mean that a manufacturer must provide new features, redesign the interface or maintain every optional cloud service indefinitely.
The CRA’s vulnerability-handling obligations must be distinguished from broader commercial commitments concerning product functionality.
The full regulation establishes the legal framework for determining the support period and related responsibilities.
Why Security Updates Matter Even When a Device Works Perfectly
A connected product can appear to function normally while containing a security weakness.
A camera might continue recording video. A router may still provide Internet access, and a smart appliance may perform its intended function without noticeable problems.
The absence of visible malfunction does not prove that a device is secure.
Cybersecurity vulnerabilities can remain undiscovered for extended periods.
Others may become known after a product has already reached thousands of customers.
Manufacturers therefore need processes for receiving vulnerability reports, assessing their severity, developing suitable corrections and communicating relevant information.
Security updates play a central role in that process.
Depending on the product, an update may replace vulnerable software components, modify authentication behaviour or close a security weakness in a network service.
This is also why updates should come from trusted sources.
A legitimate security update is intended to improve protection, but fraudulent update messages can themselves be used to trick users into installing malicious software.
The CRA addresses the manufacturer’s responsibilities for vulnerability management and security maintenance. It does not eliminate the need for users to exercise reasonable caution when managing their devices.
From a technological perspective, the main change is the expectation that cybersecurity should be maintained throughout an appropriate support period, rather than addressed only during initial development.
Will the Cyber Resilience Act Apply to Devices People Already Own?
This question requires a particularly careful distinction between the regulation’s reporting obligations and its broader product requirements.
The mandatory reporting obligations introduced in September 2026 can apply to covered products already placed on the EU market before December 2027.
However, the broader cybersecurity obligations have different transitional provisions.
According to the European Commission’s explanation of the CRA, products with digital elements placed on the market before 11 December 2027 are generally subject to the main requirements only if they undergo a substantial modification from that date.
This means the regulation does not automatically require every existing smartphone, television or smart home device to be redesigned to meet all the future product-security requirements.
A device purchased several years ago will not necessarily acquire a new minimum support commitment merely because the legislation reaches its full application date.
For consumers, this is a crucial distinction.
The regulation is intended to improve the security of products entering the European market under the applicable framework, but it should not be interpreted as a universal retroactive guarantee for all previously purchased equipment.
In the meantime, owners of existing connected products should continue checking official manufacturer support information and applying available security updates.
The gradual implementation of the CRA reflects the technical and organisational changes required across the hardware and software industry.
What Does the CE Marking Mean Under the New Rules?
European consumers are already familiar with the CE marking displayed on many electronic products.
Under the Cyber Resilience Act, manufacturers of covered products will need to demonstrate compliance with the applicable cybersecurity requirements through the relevant conformity assessment procedures.
Following successful assessment, manufacturers will draw up an EU declaration of conformity and affix the CE marking.
For many products, the assessment process may involve internal controls conducted by the manufacturer.
However, particular categories of important or critical products may be subject to more demanding procedures, potentially involving independent notified bodies.
This is not a universal requirement for every smartphone application or connected appliance.
The appropriate conformity assessment process depends on the product’s classification and the relevant rules.
It is also important to understand what CE marking does not mean.
A CE mark is not a guarantee that a device is impossible to hack.
Nor does it necessarily mean that every product has been independently penetration-tested by an external laboratory.
It indicates conformity with applicable EU requirements under the relevant assessment framework.
Cybersecurity is not a permanent condition achieved once and never reconsidered.
New vulnerabilities can emerge after a product has been released, which is precisely why vulnerability handling and security maintenance are central elements of the CRA.
What About Open-Source Software?
The Cyber Resilience Act also addresses the role of open-source software in modern technology.
Open-source components are used extensively in operating systems, networking equipment, applications and connected devices.
Many commercial products depend on software developed and maintained through collaborative projects.
However, open-source development does not always follow the same organisational or commercial structure as proprietary software.
The CRA therefore distinguishes between different situations.
Free and open-source software supplied outside the scope of a commercial activity is generally treated differently from software brought to market commercially.
Individual contributors are not automatically treated as manufacturers merely because they contribute code to a project.
The regulation also introduces the category of open-source software stewards.
These are certain legal entities that provide sustained support for qualifying open-source projects and play a role in maintaining their viability.
They are subject to a specific, tailored set of obligations rather than being treated identically to every commercial device manufacturer.
Their relevant CRA reporting obligations are scheduled to apply from 11 December 2027.
The European Commission’s explanation of the open-source provisions emphasises the need to protect cybersecurity while recognising the distinctive contribution of open-source development.
This is technically significant because stronger product-security rules must account for the software supply chains that modern devices rely on.
A manufacturer cannot simply assume that a component is secure because its code is publicly available.
At the same time, the regulatory framework must distinguish commercial product responsibility from voluntary software contributions.
How the Cyber Resilience Act Differs From NIS2
The European Union has introduced several cybersecurity initiatives, and their names can easily cause confusion.
The Cyber Resilience Act and the NIS2 Directive address related challenges, but they focus on different parts of the digital environment.
NIS2 primarily concerns cybersecurity risk management and incident-reporting obligations for specified entities operating in relevant sectors.
The CRA focuses on the cybersecurity of covered hardware and software products made available on the European market.
In practical terms, NIS2 may affect how a particular organisation manages cybersecurity risks, while the CRA addresses the security requirements associated with a product developed or marketed by a manufacturer.
These frameworks can overlap in their practical consequences.
An organisation may use technology products covered by the CRA while also being subject to separate cybersecurity obligations of its own.
However, one framework does not replace the other.
The European Commission identifies the CRA as a complementary part of the EU’s broader cybersecurity policy framework.
Understanding this distinction helps explain why the CRA matters to everyday consumer technology as well as industrial hardware and software.
It is concerned with the security properties of the products themselves, not only with the organisations operating them.
Why 2026 Is a Turning Point for European Product Cybersecurity
The CRA entered into force on 10 December 2024, but its implementation follows a phased timetable.
This makes 2026 a particularly important year.
Provisions concerning the notification of conformity assessment bodies began applying in June.
On 27 July, the European Commission published additional practical guidance to help manufacturers and developers prepare for compliance.
That guidance addresses questions about the scope of the law, risk assessment, substantial product modifications, support periods and reporting.
The Commission also provided examples and explanatory material intended to help smaller organisations understand their obligations.
Then, on 11 September, the reporting requirements became applicable and ENISA launched the initial capability of its Single Reporting Platform.
The next major milestone is 11 December 2027, when the CRA’s main cybersecurity requirements will apply.
The timeline demonstrates a gradual transition rather than a single overnight regulatory change.
Manufacturers need time to evaluate their development practices, documentation, security processes and product support strategies.
The development of harmonised technical standards and conformity assessment arrangements also forms part of this transition.
According to the Commission’s July 2026 implementation guidance, the objective is to provide clearer and more practical information before the broader compliance deadline.
For the technology sector, the period between 2026 and 2027 is therefore not merely administrative.
It is a preparation phase that may influence how future products are designed, tested and maintained.
Can Stronger Cybersecurity Rules Change the Way We Choose Technology?
Consumers usually evaluate technology through visible characteristics.
A smartphone’s camera, a laptop’s processor or a smart speaker’s sound quality can be compared relatively easily.
Security is more difficult to evaluate.
A product may look modern, perform well and offer competitive features while relying on software with inadequate maintenance.
The CRA seeks to improve this situation by introducing common requirements and clearer information about security support.
If implemented effectively, it could make certain aspects of cybersecurity easier for consumers to consider when comparing products.
The duration of vulnerability support is particularly relevant.
A device intended for long-term use becomes less attractive if its manufacturer cannot provide reliable information about future security maintenance.
However, the relationship between cybersecurity and purchasing decisions extends beyond technical specifications.
It also concerns trust in the companies selling connected products.
A forthcoming analysis from Targeted.gr will explore this relationship in “Security as a Brand Promise: Why Software Support Is Becoming Part of Customer Trust”
That article will focus on how support commitments, vulnerability communication and product reliability can influence customer expectations and brand positioning.
The business implications will be examined separately by Market Insiders, in “The Economics of Secure-by-Design: What Europe’s Cyber Resilience Act Means for Businesses”
That analysis will address the financial considerations behind secure software development, conformity assessment, vulnerability management and long-term support.
These perspectives are connected to the technical changes introduced by the CRA, but they address different questions.
For manufacturers, cybersecurity is becoming a more explicit part of product responsibility.
For consumers, it may become an increasingly relevant factor when deciding which device to purchase.
Does the Cyber Resilience Act Make Every Connected Device Safe?
No regulation can eliminate every cybersecurity vulnerability.
Hardware and software are complex systems, and even carefully designed products can contain weaknesses that are discovered only after release.
The CRA does not promise that connected devices will become impossible to compromise.
Instead, it establishes obligations intended to reduce avoidable risks and improve the processes used to manage vulnerabilities when they arise.
Its effectiveness will depend on several factors.
Manufacturers must implement the requirements appropriately. Conformity assessments must reflect the relevant risks, and market surveillance authorities need to enforce the applicable rules.
The quality and availability of security updates will also remain important.
A manufacturer may provide an update, but users can still face risks if they ignore it, install untrusted software or expose devices through insecure configurations.
In other cases, an organisation’s broader network security may determine whether a product vulnerability becomes part of a larger incident.
This means cybersecurity remains a shared practical responsibility, even when legal duties are placed more clearly on manufacturers.
The difference introduced by the CRA is that fundamental product security cannot simply be treated as a matter for users to solve after purchase.
The technology must be developed and maintained with appropriate safeguards in mind.
How Can Consumers Prepare Before Buying Their Next Smart Device?
Although the CRA’s broader product requirements will not apply fully until December 2027, consumers can already make better-informed choices.
One useful starting point is to look beyond the advertised features.
Before purchasing a router, camera or other connected product, check whether the manufacturer publishes information about security updates and product support.
It is also worth identifying whether the product uses automatic security updates, whether updates are easy to install and whether the manufacturer provides an official channel for security advisories.
For equipment intended to remain in service for years, the expected support period deserves particular attention.
Another consideration is the role of cloud services.
Some devices depend heavily on remote infrastructure, while others can perform significant functions locally.
These differences may influence privacy, reliability and the device’s behaviour when its Internet connection becomes unavailable.
The specific technical checks will vary between products.
A forthcoming practical guide from Techrow.gr, “How to Check a Smart Device’s Security Support Before You Buy It” will examine how users can evaluate firmware support, security policies, software updates and related information before making a purchase.
For now, the key principle is simple: cybersecurity should be part of the purchasing decision, not something considered only after a problem occurs.
The Future of Connected Devices Will Depend on More Than Features
The Cyber Resilience Act marks an important development in the relationship between technology manufacturers, software developers and the people using their products.
Connected devices have become integrated into homes, workplaces and public infrastructure, but the security of those devices has not always received the same attention as performance or convenience.
The new European framework attempts to address that imbalance.
By introducing security requirements for covered hardware and software, placing greater emphasis on vulnerability management and creating coordinated reporting obligations, the CRA seeks to make cybersecurity a more consistent characteristic of products sold within the EU.
Its phased implementation also matters.
As of October 2026, mandatory reporting obligations are already operational, while the wider product-security requirements are scheduled to apply from December 2027.
The transition will not eliminate cyber threats or automatically make every older device secure.
It does, however, establish a different expectation about responsibility.
For Athens Pulse, the most significant technological shift is not simply that manufacturers will have another set of rules to follow.
It is that cybersecurity is increasingly being treated as an essential part of what a digital product is, how it is built and how long it remains trustworthy.
The next generation of connected devices may be judged not only by what they can do on the day they are purchased, but also by how securely they continue to operate throughout their useful lives.
Frequently Asked Questions About the Cyber Resilience Act
What is the EU Cyber Resilience Act?
The Cyber Resilience Act is Regulation (EU) 2024/2847, which establishes cybersecurity requirements for covered hardware and software products placed on the European Union market. It addresses secure product development, vulnerability management, user information, conformity assessment and cybersecurity reporting.
When does the Cyber Resilience Act come into effect?
The regulation entered into force on 10 December 2024. Mandatory reporting obligations for manufacturers began applying on 11 September 2026, while its main cybersecurity requirements are scheduled to apply from 11 December 2027.
Which devices are covered by the Cyber Resilience Act?
The CRA broadly covers hardware and software products with digital elements that have direct or indirect connections to devices or networks. This can include smartphones, routers, smart home devices, applications and software components. Some products are excluded or subject to other regulatory frameworks.
Does the Cyber Resilience Act require five years of security updates?
The CRA generally requires a vulnerability-handling support period of at least five years. A shorter period may be appropriate when the product’s expected lifetime is less than five years, while products reasonably expected to remain in use longer may require extended support. These broader requirements are scheduled to apply from December 2027.
What changed under the Cyber Resilience Act in September 2026?
From 11 September 2026, manufacturers became required to report actively exploited vulnerabilities and severe incidents affecting the security of covered digital products. ENISA also launched the initial operating capability of its Single Reporting Platform for coordinated notifications.
Does the Cyber Resilience Act apply to products bought before 2027?
The reporting obligations can apply to products already placed on the EU market. However, the broader product-security requirements generally do not apply retroactively to products placed on the market before 11 December 2027 unless they undergo a substantial modification from that date.
Does CE marking guarantee that a connected device is secure?
No. CE marking indicates conformity with applicable European requirements under the relevant assessment procedure. It does not mean that a device has no vulnerabilities or cannot be compromised. Not every covered product is required to undergo the same form of independent third-party assessment.
Does the Cyber Resilience Act apply to open-source software?
It can apply to open-source software supplied commercially under the relevant conditions. The regulation also introduces a separate category of open-source software stewards with tailored obligations. Non-commercial contributions to open-source projects are not automatically treated in the same way as the commercial distribution of covered products.
Is the Cyber Resilience Act the same as NIS2?
No. The CRA primarily addresses cybersecurity requirements for covered digital products, while the NIS2 Directive establishes cybersecurity risk-management and incident-reporting requirements for specified entities. The frameworks are complementary but have different scopes.
How can consumers identify a smart device with reliable security support?
Consumers can check the manufacturer’s official support information, published security-update policies, vulnerability disclosure channels and the availability of firmware updates. Once the applicable CRA requirements take effect, clear information about the product’s security support period will become an important part of the relevant regulatory framework.