Cyber Resilience Act (EU) 2024/2847

Directly, only if you develop, commission or modify products yourself. Regulation (EU) 2024/2847 is addressed to manufacturers, authorized representatives, importers and distributors of products with digital elements. Operators who merely use such products have no duties of their own under the CRA. They benefit from it, though: manufacturers must handle vulnerabilities, provide security updates, inform users about actively exploited vulnerabilities and supply instructions with security information.

The Regulation applies to products made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network. For service companies, the role therefore decides. A manufacturer is anyone who develops or manufactures such a product, or has it designed, developed or manufactured, and markets it under its own name or trademark, including free of charge. If you ship your own remote-maintenance gateway under your own name or sell your own service software, you are a manufacturer in the sense of the Regulation. Installing and servicing other companies' products does not make you one.

For operators, the practical steps are these: ask about the support period and update commitments when buying, record the connected components for each asset, and find out who is registered with the manufacturer as the contact for security notices.

As a rule, yes. Under Article 3(1), a product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately. In a plant that covers the gateway in the cabinet, the router with VPN function, the networked controller and the maintenance software a technician connects with.

Cloud services are drawn more narrowly. Remote data processing counts only if the software is designed and developed by the manufacturer or under its responsibility and the product could not perform one of its functions without it. A service portal that the installation could do without, with no loss of function, does not fall under it.

Excluded are, among others, products covered by the medical device regulations or by vehicle type-approval rules, and products certified under the civil aviation regulation. Under Article 2(6), the Regulation also does not apply to spare parts that replace identical components and are made to the same specifications. Swapping a failed module for an identical part therefore triggers no new CRA duties for that part.

For products that also fall under other harmonization legislation, the Commission can limit the CRA's scope through delegated acts (Article 2(5)). Operators should keep the list of connected components for each asset with manufacturer and software version.

Since 11 September 2026, Article 14 has applied, with the manufacturers' reporting duties. If a vulnerability in a product is being actively exploited, the manufacturer must notify the CSIRT designated as coordinator and ENISA at the same time, through the single reporting platform. The early warning is due within 24 hours of becoming aware, a notification with general information follows within 72 hours, and the final report is due 14 days after a corrective or mitigating measure is available. Severe incidents carry the same 24 and 72 hours, with the final report due within one month of the notification.

These duties also cover products placed on the market before December 2027, as Article 69(3) provides. A gateway from 2022 is therefore already affected, provided it falls within the Regulation. Operators report nothing under the CRA, but they are the users the manufacturer must inform under Article 14(8).

From 11 December 2027 the Regulation applies in full. Newly placed products must then meet the essential cybersecurity requirements, the manufacturer must set a support period and demonstrate conformity. Products placed on the market earlier are subject to these requirements only if they are substantially modified after that date. Operators who must report under NIS2 have separate reporting deadlines of their own under that directive.

The manufacturer sets a support period during which it handles vulnerabilities and provides security updates. It must align the period with the expected time of use, reasonable user expectations and the nature of the product. Under Article 13(8), the period is at least five years unless the product is expected to be in use for less. The end date, at least month and year, must be stated in an easily accessible way at the time of purchase (Article 13(19)). Each security update provided stays available for at least ten years or for the remainder of the support period, whichever is longer (paragraph 9).

Under Annex I, Part II, updates are as a rule to be distributed without delay and free of charge. For a tailor-made product, manufacturer and business user may agree otherwise. If you buy a custom-built unit, settle that deviation in the contract deliberately instead of accepting it by default.

For older devices, Article 69(2) applies: products placed on the market before 11 December 2027 are subject to the requirements only if they are substantially modified after that date. An installed gateway without an update commitment therefore has no support entitlement under the CRA, and only the reporting duties bind the manufacturer. When replacing or adding equipment, ask for the end date of the support period. It must be stated at purchase.

Under Article 22, anyone who carries out a substantial modification of a product with digital elements and makes it available on the market, without being the manufacturer, importer or distributor, is considered a manufacturer. Two conditions have to come together: a substantial modification and making the modified product available on the market. Someone who modifies a device only within their own operation generally does not hand it to others and so does not make it available on the market. A service company that supplies or passes on a modified device to customers can fall under the rule.

A modification is substantial under Article 3(30) if, after placing on the market, it affects compliance with the essential cybersecurity requirements in Annex I, Part I, or changes the purpose for which the product was assessed. Whether different firmware, a changed remote access or new parameters cross the threshold depends on whether conformity with Annex I, Part I changes. The Regulation provides no scheme for this, so the assessment has to be justified case by case.

The consequences are limited by Article 22(2): the duties in Articles 13 and 14 apply to the part of the product affected by the modification, and to the whole product only if the cybersecurity of the whole is affected. That is less than the full manufacturer role, but it means risk assessment, documentation and reporting channels. Settle the role in the contract before such a change.

The key question is who actually receives the manufacturer's notice under Article 14(8). After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer must inform the impacted users and name corrective measures. If it knows only the service company that installed the device, the notice lands there. The service contract should therefore require the service company to forward such notices without delay, and say by when, to whom and in what form.

The purchase contract should state the support period and its end date, as Article 13(19) requires at the time of purchase. Add the commitment to free security updates, the deadline by which the manufacturer provides them, and a rule for installing updates in running plants without endangering operational safety. If updates touch the safety controller, the Machinery Regulation comes in as well.

For the remote access itself, settle who enables it, which connection it uses, how access is logged and who informs whom after an incident. Operators covered by NIS2 have to include suppliers and service providers in their risk management anyway. vi reads update and support commitments from contracts and reminds you of deadlines.