The EU Cyber Resilience Act introduces cybersecurity requirements for digital products, with implications for organisations developing, manufacturing, importing or distributing hardware and software.
The regulation applies directly in the Netherlands and other EU Member States. Its obligations take effect in phases, making it important to distinguish the reporting requirements already applicable from the wider product requirements starting in December 2027.
It addresses security throughout product development and maintenance, including how manufacturers handle vulnerabilities and provide security updates. The aim is to improve protection for businesses and consumers purchasing connected hardware and software.
The organisation’s role in the product supply chain determines its responsibilities.
- Manufacturers
Manufacturers include organisations developing a covered product, or having it developed, and marketing it under their own name or trademark. Commissioning an external developer therefore does not necessarily remove the commissioning organisation’s responsibilities.
- Importers and Distributors
Importers bring covered products from outside the EU onto the EU market. Distributors make products available further along the supply chain. Their obligations differ from those of manufacturers.
- Organisations Purchasing Products
Buying software or connected equipment for employees does not, by itself, make an employer a manufacturer, importer or distributor. Assess the actual activity, particularly where an organisation supplies products under its own brand.
Important Articles #
EU Cyber Resilience Act: Actions for Employers #
The CRA’s technical compliance work requires appropriate product, engineering, IT and legal expertise. HR can support implementation by making responsibilities and skills requirements clear.
Cybersecurity Act Netherlands: EU NIS2 Implementation #
The Cybersecurity Act Netherlands [Cyberbeveiligingswet, Cbw] is the Dutch law implementing the European NIS2 Directive. Its purpose is to enhance resilience against cyber threats such as distributed denial-of-service (DDoS) attacks and cybercrime.