Photo: Jakub Żerdzicki on Unsplash
The EU Cyber Resilience Act explained
In short: The EU Cyber Resilience Act sets security rules for almost any product with digital elements sold in the EU, from smart devices and laptops to apps and operating systems. It entered into force in December 2024. Since 11 September 2026, manufacturers must report actively exploited flaws within 24 hours, and full design rules apply from December 2027.
Why a new law was needed
Many connected products have been sold with weak default passwords, no clear update plan and no easy way to report security problems. When something went wrong, the buyer usually carried the risk. The EU's Cyber Resilience Act (CRA) shifts responsibility towards the companies that make and sell these products. It is similar in spirit to safety rules for toys or electrical goods, but for cybersecurity.
What it covers
The CRA applies to products with digital elements: hardware or software that connects, directly or indirectly, to a device or network. That includes:
- Smart home devices such as cameras, plugs, speakers and doorbells.
- Laptops, phones, routers and printers.
- Operating systems, mobile apps and many other kinds of software.
- Industrial connected equipment.
Some sectors that already have their own rules, such as medical devices and cars, are excluded, and there are special arrangements for open-source software.
The key dates
| Date | What happens |
|---|---|
| 10 December 2024 | The law entered into force. |
| 11 September 2026 | Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform. |
| December 2027 | The full product requirements apply to products placed on the EU market. |
What manufacturers must do
- Secure by design: build products with security in mind, for example no universal default passwords and secure settings out of the box.
- Handle vulnerabilities: have a way for people to report flaws, fix them and provide security updates.
- Say how long support lasts: tell buyers the support period during which security updates will be provided.
- Report quickly: an early warning within 24 hours of learning that a flaw is being actively exploited, a fuller notification within 72 hours, and a final report within 14 days of a fix being available.
- Show compliance: products that meet the rules carry the CE marking, as they do for other EU safety rules.
What changes for buyers
Over time, you should find it easier to see how long a product will receive security updates, and fewer devices should arrive with obvious weaknesses. Products on sale before December 2027 do not have to be redesigned, but their makers still have to report actively exploited flaws while the products are sold in the EU. Because many companies sell worldwide, these improvements are likely to appear outside Europe too.
Tip: Even with better laws, check the support period before you buy a connected gadget, and keep it updated. See Keeping your devices updated.
Related rules
The CRA sits alongside other measures, such as the UK's product security law and the EU's rules on repair and updates for phones. See Are smart home devices safe? and Longer-lasting phones.
Questions to ask before buying a connected product
- How many years of security updates does the maker promise?
- Does it force you to set your own password, or ship with a shared default?
- Is there a public way to report security problems?
- Does it carry the CE marking, and from late 2027, a stated support period?
If a seller cannot answer these simply, choose a different product.
Key takeaways
- The Cyber Resilience Act sets security rules for connected hardware and software sold in the EU.
- Reporting of actively exploited flaws started on 11 September 2026: 24-hour early warning, 72-hour notification.
- Full design and update requirements apply from December 2027.
- Buyers should see clearer support periods and safer default settings.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.