EU Cyber Resilience Act

When placing a product on the market the manufacturer must ensure it has been designed, developed and produced in accordance with the essential cybersecurity requirements in Annex I Part I. To that end the manufacturer must undertake a cybersecurity risk assessment for the product and take its outcome into account during planning, design, development, production, delivery and maintenance so as to minimise cybersecurity risks, prevent incidents and minimise their impact including on user health and safety. The risk assessment must be documented and updated as appropriate during the support period, must comprise at least an analysis of risks based on intended purpose, reasonably foreseeable use and the conditions of use such as the operational environment or the assets to be protected, and must indicate whether and how the Annex I Part I point (2) security requirements apply.

Applies when

Chinese manufacturers placing products with digital elements on the EU market. For robotics and smart-hardware companies this risk assessment should be planned jointly with the AI Act Art. 9 risk management and the machinery safety risk assessment, rather than producing three separate documents.

Applies from: 2027-12-11

Evidence to retain

• · Product cybersecurity risk assessment report covering intended purpose and operating environment
• · Point-by-point conformity statement against Annex I Part I
• · Security design review and security testing records
• · Records of risk assessment updates during the support period

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)

Manufacturers must establish and operate a vulnerability handling process under Annex I Part II, covering identification and documentation of vulnerabilities including a software bill of materials covering at least the top-level dependencies of the product, timely remediation or mitigation, distribution of security updates, a coordinated vulnerability disclosure policy, and communication about vulnerabilities. The process must remain effective throughout the support period and must feed the Art. 14 reporting duties.

Applies when

Chinese manufacturers placing products with digital elements on the EU market. For AI products that depend heavily on open-source components and pre-trained model dependencies, generating and maintaining an SBOM usually requires changes to the CI/CD pipeline.

Applies from: 2027-12-11

Evidence to retain

• · Vulnerability handling process document with assigned responsibilities
• · Software bill of materials in a machine-readable format, with generation and update records
• · Coordinated vulnerability disclosure policy and the external intake channel
• · Security update release records and sample user notifications

Estimated first-time effort: 20–50 person-days (estimate, not a commitment)

Manufacturers must determine a support period during which security updates are provided and vulnerability handling is maintained. In determining it, they must take into account users’ reasonable expectations of support duration, the nature and intended purpose of the product, relevant Union law, the support periods of integrated third-party components providing core functions, and relevant guidance from ADCO and the Commission, considering these matters proportionately. Without prejudice to those factors the support period must be at least five years, or the expected time in use where a product is expected to be in use for less than five years. Manufacturers must include the information taken into account in the Annex VII technical documentation.

Applies when

Chinese manufacturers placing products with digital elements on the EU market. The commercial impact is direct: hardware margin models must budget for five years of security updates, and where third-party components such as chip SDKs, open-source libraries or cloud inference dependencies are supported for less than five years, replacement plans must be made in advance.

Applies from: 2027-12-11

Evidence to retain

• · Support period determination rationale covering the factors considered and the proportionality reasoning
• · Inventory of third-party integrated components with their support periods and expiry tracking
• · Support period information published for users
• · The support period entry in the technical documentation

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Manufacturers must notify actively exploited vulnerabilities contained in their products, simultaneously to the CSIRT designated as coordinator under Art. 14(7) and to ENISA, via the single reporting platform under Art. 16: an early warning within 24 hours of becoming aware, indicating where applicable the Member States where the product is known to have been made available; a vulnerability notification within 72 hours giving general information about the product, the general nature of the exploit and the vulnerability, corrective or mitigating measures taken and those users can take, and indicating how sensitive the manufacturer considers the information to be; and a final report no later than 14 days after a corrective or mitigating measure is available, including a description of the vulnerability with its severity and impact, information on any malicious actor exploiting it, and details of the security update or other corrective measures made available.

Applies when

Chinese manufacturers placing products with digital elements on the EU market. This duty applies from 11 Sep 2026, ahead of full application, so reporting channels and on-call arrangements cannot wait until late 2027.

Deadline: 24-hour early warning; 72-hour vulnerability notification; final report within 14 days after a corrective or mitigating measure is available.

Applies from: 2026-09-11

Evidence to retain

• · Vulnerability and incident reporting playbook breaking down the 24-hour, 72-hour and 14-day deadlines into tasks
• · Single reporting platform account details and submission acknowledgements
• · Determination records for classifying a vulnerability as actively exploited
• · User-facing mitigation advisories and their publication records

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Manufacturers must notify severe incidents having an impact on the security of a product with digital elements, simultaneously to the coordinating CSIRT and ENISA via the Art. 16 single reporting platform: an early warning within 24 hours of becoming aware, stating at least whether the incident is suspected of being caused by unlawful or malicious acts and indicating where applicable the Member States where the product is known to have been made available; an incident notification within 72 hours; and a final report within one month after submission of that notification under Art. 14(4)(c), covering a detailed description of the incident including its severity and impact, the type of threat or root cause likely to have triggered it, and applied and ongoing mitigation measures. The obligation applies from 11 Sep 2026.

Applies when

Chinese manufacturers placing products with digital elements on the EU market. For manufacturers with no main establishment in the Union, Art. 14(7) fixes the coordinating CSIRT by a determinate order: (a) the Member State where the authorised representative acting for the highest number of products of that manufacturer is established; (b) where the importer placing the highest number of its products on the market is established; (c) where the distributor making the highest number available is established; (d) the Member State with the highest number of users of its products — on the information available to the manufacturer. So the destination can be settled in the playbook before any incident occurs. Together with NIS2 Art. 23, GDPR Art. 33 and AI Act Art. 73 this creates four parallel reporting clocks, which should be sequenced in a single incident response playbook to avoid missed filings or inconsistent accounts.

Deadline: 24-hour early warning; 72-hour incident notification; a final report within one month after submission of the incident notification (Art. 14(4)(c)), unless the relevant information has already been provided.

Applies from: 2026-09-11

Evidence to retain

• · Severe incident criteria and classification records
• · Submission records for the 24-hour early warning and 72-hour notification
• · Cross-regime reporting timeline matrix
• · Post-incident remediation and user advisory records

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

After becoming aware of an actively exploited vulnerability or of a severe incident having an impact on the security of the product, the manufacturer must inform the impacted users — and where appropriate all users — of that vulnerability or incident and, where necessary, of any risk mitigation and corrective measures they can deploy, where appropriate in a structured, machine-readable format that is easily automatically processable. Where the manufacturer fails to inform users in a timely manner, the notified CSIRTs designated as coordinators may provide that information. This duty is triggered by the same moment of awareness as the Art. 14(1)/(3) notifications and is a separate, outward-facing duty that filing with the CSIRT and ENISA does not discharge.

Applies when

Chinese manufacturers placing products with digital elements on the EU market. Practical point: the Article sets no hour count, but it is triggered at the same moment as the 24-hour early warning, so drafting and publishing the user advisory should start alongside the notification playbook rather than after the final report.

Deadline: No statutory hour count; triggered by the same awareness as Art. 14(1)/(3) and required to be timely — otherwise the coordinating CSIRT may inform users instead.

Applies from: 2026-09-11

Evidence to retain

• · User advisory text and publication timestamps
• · Records determining the impacted user population (why some users rather than all)
• · User-actionable mitigation and corrective measure instructions
• · Production and distribution records for the structured machine-readable advisory, where applicable

Estimated first-time effort: 2–8 person-days (estimate, not a commitment)

Manufacturers must perform a conformity assessment of the product and of their own processes to determine whether the Annex I essential requirements are met, using the Annex VIII internal control procedure (module A), EU-type examination (module B) followed by conformity to type based on internal production control (module C), full quality assurance (module H), or where available and applicable a European cybersecurity certification scheme under Art. 27(9). For important products in Annex III class I, where harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial" have not been applied or only partly applied, or do not exist, module B+C or module H is mandatory. For important products in Annex III class II, module B+C or module H (or an applicable certification scheme) is mandatory. On completion the manufacturer draws up the Annex VII technical documentation, issues the EU declaration of conformity and affixes the CE marking.

Applies when

Chinese manufacturers placing products with digital elements on the EU market. The first step is to confirm whether the product falls into the Annex III important-product classes, since that determines whether a notified body is mandatory, and to budget and schedule certification accordingly.

Applies from: 2027-12-11

Evidence to retain

• · Product classification record (default, Annex III class I, class II or critical product)
• · Conformity assessment report or notified body certificate
• · Complete Annex VII technical documentation
• · EU declaration of conformity and evidence of CE marking

Estimated first-time effort: 30–90 person-days (estimate, not a commitment)

A manufacturer may appoint an EU authorised representative by written mandate; the obligations in Arts. 13(1)-(11), the first subparagraph of Art. 13(12) and Art. 13(14) cannot form part of that mandate. The mandate must at least allow the representative to keep the Art. 28 EU declaration of conformity and the Art. 31 technical documentation at the disposal of market surveillance authorities for at least 10 years after the product is placed on the market or for the support period, whichever is longer; to provide, on a reasoned request from a market surveillance authority, all information and documentation necessary to demonstrate conformity; and to cooperate with market surveillance authorities on any action taken to eliminate risks posed by products covered by the mandate. Importers and distributors have their own verification duties from Art. 19 onwards, so channel contracts must allocate responsibility for delivering documentation and cooperating with investigations.

Applies when

Chinese manufacturers selling through EU importers, distributors or their own EU entity. In practice EU importers will require the technical documentation and declaration of conformity before shipment, since otherwise they bear their own liability under Art. 19.

Applies from: 2027-12-11

Evidence to retain

• · Authorised representative mandate and the scope of the mandate
• · Documentation retention arrangement for 10 years or the support period, whichever is longer
• · Compliance responsibility allocation clauses with importers and distributors
• · Records of channel partner documentation requests and cooperation with investigations

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)