Term from the Cyber Resilience Act: hardware or software whose intended purpose includes a data connection to a device or network. This includes connected controllers, gateways and service software.
“Product with digital elements” is the central term of the Cyber Resilience Act (Regulation (EU) 2024/2847). Under Article 3, point (1), it is a software or hardware product together with its remote data processing solutions, including components placed on the market separately. The scope (Article 2(1)) covers products whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. In industrial assets, that means connected controllers, gateways, remote maintenance modules and service software, plus cloud components without which the product could not perform one of its functions.
The duties fall mainly on manufacturers: cybersecurity requirements from the design stage, orderly handling of vulnerabilities throughout the support period, documentation, and reporting of actively exploited vulnerabilities. The reporting duties have applied since September 11, 2026, and all other duties apply from December 11, 2027. Products placed on the market before December 11, 2027 have to meet the requirements only if they are substantially modified after that date (Article 69(2)). The reporting duty under Article 14 does apply to them as well (Article 69(3)). Spare parts that replace identical components are excluded (Article 2(6)), as are products covered by the Medical Devices Regulations (EU) 2017/745 and 2017/746 (Article 2(2)).
For operators, this brings no duty catalog of their own, but it is a purchasing and contract matter. When you buy assets or sign maintenance contracts, you should know which components are connected, how long the manufacturer will supply security updates, and how vulnerabilities are reported. Under Article 22, anyone who substantially modifies a connected component and then makes it available on the market is considered a manufacturer. Together with NIS 2 and the Data Act, an overview of the connected components per asset is the basis for regulating remote access and proving that updates were installed.
What matters
- List the connected components for each asset: controller, gateway, router, remote maintenance module, service software.
- At purchase, ask about the support period and about how vulnerabilities are reported.
- Have installed updates confirmed in the service report, with the version number.
- Put it in the contract who installs updates and who bears the risk if updates do not arrive.
Suppose a refrigeration system sends its operating data through a gateway to the service company's portal. The operator adds the gateway and the portal to his list of connected components and asks the manufacturer for the end of the support period. With the service company, he agrees that updates will be confirmed in the service report together with the version number.
In the original wording
“‘product with digital elements’ means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately”
“This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”