What the EU Cyber Resilience Act means for software makers
The EU's Cyber Resilience Act sets cybersecurity requirements for hardware and software products with digital elements sold in the European Union. Full enforcement begins in December 2027, though some reporting obligations started in September 2026. Products must satisfy 13 guidelines covering secure defaults, updateability, data privacy, deletion and portability, and protection against known vulnerabilities.
The CRA covers products with digital components offered for sale in the EU, whether sold directly or through distribution chains. It affects devices such as smartwatches, smartphones, data center equipment, industrial gear, and the software running on them. Full enforcement starts December 2027, but initial reporting duties began September 2026.
Thirteen guidelines require secure default settings, protection from unauthorized access, update capability, privacy safeguards, user deletion, and data portability. Products should ship without known vulnerabilities, supported by an SBOM listing components and code libraries. Open source rules were revised after community input; commercially supported open source efforts must fix the projects they back.
The CRA may reshape how software and connected devices reach EU users, affecting manufacturers, developers, and open source maintainers. Consumers could benefit from stronger default security, timely updates, and clearer data controls. Smaller developers and free projects may face compliance burdens, potentially reducing product variety or delaying launches. Global firms selling into the EU could align practices worldwide, spreading security expectations beyond Europe.