A date many manufacturers have not yet marked in their calendar is only weeks away: on 11 September 2026 the first operational obligations of the Cyber Resilience Act take effect — Regulation (EU) 2024/2847, which introduces mandatory cybersecurity requirements for all products with digital elements sold in the European Union. It is not just about software vendors: it covers connected machinery, automation components, IoT devices, industrial and consumer electronics. If your product has a microprocessor and communicates with anything, it is almost certainly in scope.
From that date, Article 14 of the Regulation applies: manufacturers are required to report actively exploited vulnerabilities and severe incidents affecting their products to the authorities. This is not a recommendation — it is a legal obligation with very tight deadlines and penalties attached.
For an actively exploited vulnerability the sequence is:
For a severe incident impacting the security of the product, the cascade is similar: early warning within 24 hours, notification within 72 hours, final report within one month. Reports go through the single European reporting platform to ENISA and the competent national CSIRT.
The practical point is simple: 24 hours is very little time. Companies without an internal process to collect, assess and escalate security events will not meet the deadline by improvising.
The CRA applies to “products with digital elements”: hardware and software, professional and consumer, placed on the EU market. For industry this includes connected machinery and control cabinets, PLCs and automation components, connected sensors and instrumentation, HMIs, gateways, industrial software and supervision apps. Only products already covered by equivalent sector rules (medical devices, automotive, aviation) and a few special cases are excluded.
Mind the supply chain too: the main obligations fall on the manufacturer, but importers and distributors have their own verification duties — and whoever puts their brand on someone else’s product takes on the manufacturer’s responsibilities.
Classification follows the product’s core function: the first step of any compliance journey is understanding which class you fall into — and therefore whether a notified body will be required.
Non-compliance with the essential requirements can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Breaches of other obligations — including reporting — carry lower but still significant ceilings. On top of fines: market withdrawal and reputational damage.
Xefra supports manufacturers along the whole journey: product classification, gap analysis against the essential requirements, set-up of the vulnerability handling and reporting process, technical documentation and conformity assessment. Our background as a notified body and testing laboratory — where functional safety meets cybersecurity — is the right starting point to be ready for the CRA deadlines. Contact us for an initial assessment of your product portfolio.
Yes, whenever it contains digital elements — which is the case for almost all modern machinery. The CRA sits alongside the new Machinery Regulation 2023/1230, which itself introduces protection-against-corruption requirements for control systems: the two regulations should be addressed together.
Breaching the reporting obligations is subject to penalties and, where damage occurs, worsens the manufacturer’s position in liability terms as well. A working internal process is the real protection.
The reporting obligations from 11 September 2026 also concern products already on the market with active support. The full essential requirements apply to products placed on the market from 11 December 2027; substantial modifications to existing products can bring them into scope.
No: for most products (default class) self-assessment is enough. It becomes mandatory for important class II products and, in the form of certification, for critical ones. Classification comes first.
With the product inventory and classification, because everything else — path, cost, timing — follows from it. In parallel, set up the reporting process: it is the obligation with the nearest deadline.
Last updated: August 2026. Reference: Regulation (EU) 2024/2847 (Cyber Resilience Act).
For queries or requests, please get in contact: info@xefracert.com or +39 010 455 6368
