6 min read
The EU Cyber Resilience Act introduces cybersecurity requirements for digital products, with implications for organisations developing, manufacturing, importing or distributing hardware and software. The regulation applies directly in the Netherlands and other EU Member States. Its obligations take effect in phases, making it important to distinguish the reporting requirements already applicable from the wider product requirements starting in December 2027.
For management and HR, preparation includes identifying responsibilities, building relevant skills and ensuring employees know how to escalate security concerns.
AT A GLANCE
What Is the EU Cyber Resilience Act?
The Cyber Resilience Act Regulation (EU) 2024/2847, also known as the CRA, establishes cybersecurity requirements for products with digital elements made available on the EU market.
It addresses security throughout product development and maintenance, including how manufacturers handle vulnerabilities and provide security updates. The aim is to improve protection for businesses and consumers purchasing connected hardware and software.
| Date | Legal development |
|
December 10, 2024 |
The regulation entered into force. |
|
June 11, 2026 |
Provisions concerning the notification of conformity assessment bodies began applying. |
|
September 11, 2026 |
Manufacturers’ reporting obligations began applying. |
|
December 11, 2027 |
The main requirements apply, subject to transitional provisions. |
Organisations in Scope
The organisation’s role in the product supply chain determines its responsibilities.
-
Manufacturers
Manufacturers include organisations developing a covered product, or having it developed, and marketing it under their own name or trademark. Commissioning an external developer therefore does not necessarily remove the commissioning organisation’s responsibilities.
-
Importers and Distributors
Importers bring covered products from outside the EU onto the EU market. Distributors make products available further along the supply chain. Their obligations differ from those of manufacturers.
-
Organisations Purchasing Products
Buying software or connected equipment for employees does not, by itself, make an employer a manufacturer, importer or distributor. Assess the actual activity, particularly where an organisation supplies products under its own brand.
Products in Scope
The regulation covers hardware and software products whose intended purpose or reasonably foreseeable use includes a direct or indirect connection to a device or network. Products can include standalone software, connected equipment and separately marketed components. Certain remote data-processing solutions also fall within scope.
However, not every digital service is automatically covered, the treatment of remote processing and the rules for free and open-source software require individual assessment.
Main Product Requirements
Manufacturers must incorporate cybersecurity into the planning, design, development and maintenance of covered products.
The preparation includes assessing cybersecurity risks, addressing vulnerabilities and documenting compliance. Before placing covered products on the market under the applicable requirements, manufacturers must complete the appropriate conformity assessment and provide the required declaration and CE marking.
Organisations should establish the correct assessment route early enough to accommodate development and launch plans.
Cyber Resilience Act: Reporting Obligations
Since September 11, 2026, manufacturers must report:
- Actively exploited vulnerabilities.
- Severe incidents affecting the security of covered products.
The principal notification stages are:
| Stage | Deadline |
| Early warning | Within 24 hours of becoming aware |
|
Main notification |
Within 72 hours of becoming aware |
|
Final vulnerability report |
Within 14 days after a corrective or mitigating measure becomes available |
|
Final severe-incident report |
Within one month after the main notification |
Reports should be submitted through the CRA Single Reporting Platform. These deadlines described above, make internal escalation arrangements important: employees need to know whom to contact immediately when a potentially reportable issue is discovered.
Requirements Taking Effect December 11, 2027
- CE marking & conformity: It is not possible to sell a product with digital elements in the EU without meeting essential cybersecurity requirements and bearing a CE mark.
- Mandatory support period: Manufacturers must provide security updates and vulnerability handling for a support period of at least five years (or the expected lifecycle of the product).
- Technical documentation & SBOM: Manufacturers must generate full technical documentation, an EU declaration of conformity, and a Software Bill of Materials (SBOM).
- Conformity assessment tiers: Most products rely on self-assessment, while important (Annex III) and critical (Annex IV) products require third-party assessment through notified bodies.
- Penalties: Non-compliance can result in administrative fines of up to EUR 15 million or 2.5% of worldwide annual turnover (whichever is higher) for core requirement breaches.
Actions for Employers, IT and HR
The CRA’s technical compliance work requires appropriate product, engineering, IT and legal expertise. HR can support implementation by making responsibilities and skills requirements clear.
Step 1. Define Responsibilities
Identify who assesses product scope, manages vulnerabilities, approves notifications and communicates with customers. Name deputies so that reporting does not depend on one person being available.
Step 2. Identify Skills Gaps
Assess the training needed by developers, product managers, customer-support teams and employees handling security reports. It is important to tailor training to their responsibilities.
Step 3. Review Escalation Procedures
It is important to test how a security concern moves from the employee receiving it to the team responsible for assessment. Concerns reported through customer-service channels and external researchers should also be included in the assessment.
Step 4. Coordinate Organisational Changes
Where preparation involves changes to roles, working arrangements or employee-monitoring systems, it is key to assess the relevant employment, privacy and employee-representation requirements separately.
These are practical preparation steps. They do not mean that the CRA creates an identical HR training or consultation obligation for every employer.
The key is to establish which products and supply-chain roles fall within scope of the legislation. The next step is to connect the legal requirements to product development, reporting procedures, staffing and training.
Frequently Asked Questions
How Does the Cyber Resilience Act Differ from NIS2?
The Cyber Resilience Act focuses on the cybersecurity of covered products. NIS2 focuses on cybersecurity risk management and incident reporting by organisations within its scope. In the Netherlands, the Dutch Cybersecurity Act implements the NIS2 framework.
An organisation may need to assess both regimes. Compliance with one should not be treated as automatically satisfying the other. The European Commission describes the CRA as complementing NIS2.
Do Small Businesses Have to Comply?
Small size does not create a general exemption for manufacturers of covered products. The CRA provides measures intended to support micro-enterprises and SMEs (Small and Medium-sized Enterprises), including guidance, training initiatives and access to financial or technical support. Smaller organisations should assess their obligations before assuming that the regulation concerns only large technology companies.
