Reinier advises national and international companies
reinier.russell@russell.nl +31 20 301 55 55The European Cyber Resilience Act sets out new requirements for smart devices and software. What do manufacturers, importers and distributors need to bear in mind from now on?
The European Digital Decade is increasingly taking shape through legislation. The European Union aims to create an environment in which innovation is encouraged in a responsible manner, whilst prioritising the safety of citizens and businesses. It is within this framework that the Cyber Resilience Act (CRA) has been established. In this blog, we provide a brief overview of the CRA and discuss the implications it may have for you as a business owner.
Cyber resilience refers to the ability of digital products to withstand digital attacks. Examples include wireless or remotely controlled systems. A vulnerability that would allow a third party to remotely set the temperature of a smart thermostat to 50 or -5 degrees illustrates the kind of risks against which the Act aims to provide protection.
The aim of the Cyber Resilience Act is to improve the security of products with digital elements, including network equipment, Internet of Things (IoT) devices such as smartphones and other smart devices, and software such as video games, mobile applications and operating systems. The Act offers citizens a higher level of protection by improving the security of digital products throughout their lifecycle. The Act entered into force in part on 11 June 2026 and is directly applicable in the Member States; it therefore applies directly to you.
Among other things, the CRA governs the processes by which manufacturers develop, design, produce and maintain their digital products. Digital products are classified into different categories:
Before a product is placed on the market, the manufacturer must determine which category the product falls into. This involves assessing whether the product’s main functionality corresponds to the technical description of one of these categories. Different obligations apply to each category. The category into which a product falls therefore determines which obligations apply to the manufacturer.
Under the CRA, there is scope for self-assessment with regard to the obligations for Class I products; in certain cases, the Act requires third-party certification for the relevant class. Products in the other classes must be subject to third-party certification. The manufacturer remains responsible for the aforementioned certification at all times. The manufacturer must ensure compliance with the law throughout the product’s entire expected lifespan, but for a minimum period of five years. This applies to all products covered by the Act, regardless of whether they were placed on the market before the Act came into force.
The manufacturer’s duty of care entails the obligation to verify that its product complies with the requirements set out in the Act. In order to develop a secure product, the manufacturer must first determine the functionality and intended operation of the product. A cybersecurity risk assessment must then be carried out. This risk analysis forms the basis for the secure design, development, manufacture and maintenance of the product and for promoting cyber resilience.
Although manufacturers are central to the CRA, other parties in the supply chain are also subject to its rules. For example, obligations apply to importers and distributors. Among other things, they must check whether products comply with the applicable requirements and must be able to make relevant documentation available. The precise obligations vary depending on the role a company plays in relation to the product. For example, manufacturers are, in principle, subject to stricter obligations than distributors.
An important part of the Act is now in force. Since 11 September 2026, the reporting obligation has applied to manufacturers of products containing digital components. They must actively report exploited vulnerabilities and serious incidents that affect the security of their products.
Reports must be submitted both to the European agency ENISA via the European CRA Single Reporting Platform and to the relevant national reporting point. In the Netherlands, this is the digital reporting portal of the National Cyber Security Centre (NCSC). If the issue affects several Member States, a report needs only be submitted to one national reporting point. The report to ENISA must specify in which Member States the product is available, according to the manufacturer’s knowledge.
Short deadlines apply to these reports. An early warning regarding an actively exploited vulnerability or a serious incident must be issued no later than 24 hours after becoming aware of it and without undue delay. A further report must then be submitted within 72 hours. For an actively exploited vulnerability, a final report must be submitted no later than 14 days after a corrective or risk-mitigating measure becomes available. For a serious incident, the final report must be submitted within one month of the initial report made within 72 hours.
The reporting obligation goes beyond the requirement to report incidents. Under the CRA, manufacturers must also establish processes to identify, assess and remedy vulnerabilities in a timely manner. For example, the provision of a security update may form part of the required response.
For businesses that develop digital products or market them under their own name, it is important to assess now which obligations under the Act apply to them. In doing so, they must consider not only the technical characteristics of the product, but also the organisation of internal processes. This includes carrying out and documenting risk analyses, managing vulnerabilities, making security updates available and being able to submit a notification in a timely manner.
Companies acting as importers or distributors are also affected by the Act. Among other things, they must verify that the products they place on the market comply with the applicable requirements and must be able to demonstrate that they have fulfilled their obligations. Importers must actively verify that the product complies with the legal requirements. An importer who places a product on the market under their own name is regarded as a manufacturer and must comply with the stricter legal obligations. Distributors are only required to check the CE marking on the product.
The CRA will come into force gradually. The reporting obligation for manufacturers of products with digital elements has been applied since 11 September 2026. On 11 December 2027, the remaining key obligations under the Act will come into force. From that date, products with digital elements placed on the market in the EU must comply with the requirements of the CRA, including those relating to security-by-design and the management of vulnerabilities.
Companies would therefore be well advised not to wait until December 2027. Setting up processes relating to cybersecurity requires preparation. This is because the CRA affects not only the technical aspects of a product, but also the organisation, documentation and responsibilities within the company.
Do you have any questions regarding this blog? Or do you need advice on the legal aspects of ICT? Our lawyers will be happy to assist you, including if you wish to bring a dispute to our attention. Please contact us:
This newsletter highlights the key developments in EU law and their practical implications for the aviation sector.
The regulation of charities and nonprofit organizations is changing rapidly. New rules, stricter audits, and European legislation are making it more important than ever for organizations to stay on top of their compliance obligations. In this newsletter, we outline the most important developments for you.
European regulatory developments are introducing major new obligations for companies in the retail, fashion and luxury sectors. Companies must prepare their compliance processes accordingly.
On 2 June 2026, the Dutch Senate adopted the Digital General Meeting for Private Law Legal Entities Act. This Act makes it possible to hold general meetings entirely digitally. What does this mean for directors and shareholders of private limited companies, public limited companies and other legal entities?
The Transparency and Countering Undermining by Civil Society Organisations Act (Wtmo) imposed a number of new obligations on charities in the Netherlands. However, the Act has been rejected by the Dutch Senate on 24 March 2026 and will not enter into force.
The European AI Act requires employers to ensure that employees have sufficient knowledge of AI systems. This can be achieved through training, but also through an AI policy tailored to the company. What should you include in such a policy? What role does the works council play in the implementation of the AI policy?
