Since 11 September 2026, the EU Cyber Resilience Act has placed a first obligation on manufacturers: report within 24 hours any actively exploited vulnerability in a connected product sold in the Union, including products already on the market. If you design a connected device, in Switzerland or elsewhere, and sell it in the EU, the Cyber Resilience Act applies to you as a manufacturer: reporting is already in force, and the rest of the requirements arrive on 11 December 2027, in other words while your next products are still in development.
Key points
- Regulation (EU) 2024/2847, known as the Cyber Resilience Act (CRA), covers hardware and software products that connect, directly or indirectly, to a device or a network.
- Since 11 September 2026: early warning within 24 hours, notification within 72 hours and a final report for any actively exploited vulnerability or severe incident, through ENISA's single reporting platform.
- From 11 December 2027: essential cybersecurity requirements, vulnerability handling for at least five years, technical documentation and CE marking.
- A Swiss manufacturer selling in the EU is subject to it just like a European one. Switzerland is preparing its own law, which will be "based on" the CRA.
- This article summarises the official text; it is not legal advice.
What is happening: the Cyber Resilience Act and manufacturers
A regulation in three stages
The regulation was signed on 23 October 2024 and published in the Official Journal on 20 November 2024. Its Article 71 sets three dates. The chapter on notified bodies has applied since 11 June 2026. Article 14, on reporting obligations, has applied since 11 September 2026. Everything else applies from 11 December 2027.
The scope is broad: any product with digital elements whose intended or reasonably foreseeable use includes a data connection to a device or a network (Article 2). A Wi-Fi sensor, a machine controlled by an app, a Bluetooth module, software sold on its own. Some sectors have their own regulation and are excluded, such as medical devices and vehicles.
What already applies: reporting
As soon as a manufacturer learns that a vulnerability in its product is being actively exploited, Article 14 requires three submissions: an early warning within 24 hours, a notification within 72 hours describing the flaw and the measures taken, then a final report no later than 14 days after a fix is available. For a severe incident affecting the product's security, the final report is due within one month of the notification. The manufacturer must also inform the affected users and tell them what they can do.
These reports go through a single platform, opened by ENISA, the EU cybersecurity agency, on the very day the rules took effect. They reach the national response team designated as coordinator and ENISA at the same time. One key point: under Article 69, this obligation also covers products placed on the market before 11 December 2027. Stock you have already sold is included.
What comes in December 2027
From 11 December 2027, a product may only be placed on the market if it meets the essential requirements of Annex I: no known exploitable vulnerability at launch, a secure-by-default configuration, the ability to receive security updates, protection of data and access, and a limited attack surface. The manufacturer will have to document a risk assessment, keep a software bill of materials (SBOM) covering at least the top-level dependencies, publish an address for reporting flaws, and handle vulnerabilities for a support period of at least five years, unless the product is expected to be used for a shorter time. Each security update must remain available for at least ten years. Compliant products bear the CE marking.
Penalties are set by the Member States, within the ceilings of Article 64: up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher, for breaches of the essential requirements and of Articles 13 and 14.
What it means for you
The CRA does not care where your design office is. It applies to products made available on the Union market. A "manufacturer", in the regulation's sense, is whoever designs or has a product designed and markets it under their own name or trademark. The text even sets out what a manufacturer with no establishment in the EU should do: it reports to the Member State of its authorised representative, failing that its importer, its distributor, or the one where most of its users are.
For a Swiss SME that manufactures a connected device, there are three practical consequences:
- Right now, you need someone able to recognise an exploited flaw and report it within 24 hours. A generic mailbox read once a week will not do.
- Your European importers and distributors will ask you for proof: Article 19 forbids an importer from placing a product on the market if the manufacturer has not carried out the conformity assessment and drawn up the technical documentation.
- Your products in development will be sold after December 2027. The choices you make on the prototype today (components, firmware, update method) decide tomorrow's compliance.
On the Swiss side, on 25 September 2026 the Federal Council asked the DDPS to prepare, by June 2027, a draft federal cybersecurity act with binding requirements for manufacturers, importers and distributors of technical products. It states that the act will be "based on" the CRA. Preparing for the CRA therefore also means getting ahead of the future Swiss rule.
What I have learned
I design and build prototypes and pre-series: from the first working model to the small batch, I validate form, mechanics and materials before the client commits to production. The CRA adds a fourth thing to validate, and it too is decided at the workbench: how the product will be updated, and who will respond when a flaw is found.
In the Lab, I built the board, sensors and screen of an off-the-shelf filament dryer into my printer's multi-colour system: that is the CFS + Space Pi project. I reused the manufacturer's electronics as they were. For a personal build in my own workshop, the question does not arise: it is not placed on the market. But if I turned it into a product for sale, that board would become a third-party component, and Article 13 requires the manufacturer to exercise due diligence on such components: know where it comes from, who maintains it, whether it can be fixed. That question belongs to the moment you choose the board, not after the pre-series.
At home, I built an open source home automation infrastructure that runs more than thirty connected devices. I put them on an isolated network, separate from the home network and the servers, and the automations keep running without an internet connection. I did it because I had no way of knowing how those devices were updated. The CRA shifts that burden: it is no longer up to the user to protect themselves from a poorly designed device, it is up to the manufacturer to ship it secure by default and to maintain it.
What to do now
1. Take stock of your connected products
List the products sold in the EU that have a data connection: Wi-Fi, Bluetooth, USB, app, online service. For each one, note who the manufacturer is under the CRA, which importers and distributors it goes through, and in which countries it is sold.
2. Be ready to report within 24 hours
Appoint a responsible person and a deputy, publish a contact address for vulnerability reports, register on ENISA's single reporting platform and identify the competent national team. Prepare an alert template and a way to inform your users.
3. Put security in the prototype specification
A written risk assessment from the design stage, a list of third-party components and software, a unique password or secure-by-default configuration, an update mechanism proven on the prototype, and a support period decided and costed into your unit price.
4. Talk to your European partners
Ask your importers and distributors what they will expect from you in December 2027, and consider whether an authorised representative in the EU would help. Better to know before signing the next order.
5. Have it checked by a specialist
Your product's classification (default category, important or critical product) determines the conformity procedure. Have it confirmed by a lawyer or a specialised body.
Frequently asked questions
Is my prototype subject to the Cyber Resilience Act?
The regulation covers products made available on the market. A prototype may be shown at a trade fair if it carries a visible sign stating that it does not comply and will not be sold as it is (Article 4). But it is on the prototype that the choices behind the product's compliance are made.
My product has been on sale for years: am I concerned?
For reporting, yes: it also applies to products placed on the market before 11 December 2027. The other requirements only apply to those products if they undergo a substantial modification after that date (Article 69).
My company is Swiss: does the CRA really apply to me?
Yes, as soon as your product is sold in the EU, directly or through an importer. The regulation explicitly covers manufacturers with no establishment in the Union. And the future Swiss law is to be modelled on it.
Going further
Are you developing a connected device and want to build these requirements in from the prototype? See my engineering and fabrication offer, or, to frame the project upstream, strategy and guidance. The simplest way: a 20-minute call.
Sources
- Regulation (EU) 2024/2847 of 23 October 2024 (Cyber Resilience Act), Articles 2, 3, 4, 13, 14, 19, 64, 69, 71 and Annex I, Official Journal of the European Union, 20 November 2024.
- Cyber Resilience Act, European Commission, page updated 7 September 2026.
- CRA reporting obligations, European Commission, 11 September 2026.
- The CRA Single Reporting Platform is launched, ENISA, 11 September 2026.
- Federal Council plans to introduce new Cybersecurity Act, Swiss Federal Council, 25 September 2026.
- Federal Council to strengthen cyber resilience of digital products, Federal Office for Cybersecurity, 20 August 2025.
Photo: Nicolas Thomas / Unsplash (source).
Tags: Cyber Resilience Act, connected devices, prototyping, cybersecurity, manufacturers, CE marking