Law and standards

Cyber Resilience Act

What is the Cyber Resilience Act?

The Cyber Resilience Act, Regulation (EU) 2024/2847, sets security requirements for products with digital elements. It addresses those who bring such products to market: manufacturers, importers and distributors.

For most businesses the most important point is a reassuring one. Anyone who merely uses software is not placed under duties by the regulation. The duties fall on the economic operators who make a product available.

Care is needed where that line blurs. Anyone who sells a bought in product under their own name or trademark counts as a manufacturer under Article 21. The same applies under Article 22 where a product is substantially modified and then made available. Businesses that pass on devices or software carrying their own logo should have this examined.

On the dates. The regulation entered into force on 10 December 2024. The reporting duties of manufacturers for actively exploited vulnerabilities and severe incidents under Article 14 apply from 11 September 2026. The remaining duties apply from 11 December 2027. This is our interpretation of the regulation and not legal advice.

See NIS2 See consulting

Related terms

NIS2 NIS2 is EU Directive 2022/2555 on network and information security. It obliges companies in certain sectors to run risk managemen… Vulnerability and vulnerability assessment A vulnerability is a flaw or misconfiguration in software, hardware or settings that lets an attacker into a system. A vulnerabil… Patch management and updates Patch management is the disciplined handling of security updates. A patch is the correction a vendor issues to close a security f… Supply chain attack A supply chain attack uses a third party as the route into your business, for example an IT provider with remote access, a softwa…

All terms in the knowledge base

Note: This entry reflects the state of knowledge to the best of our understanding and serves as general orientation. It is not legal advice. What counts is always the version currently in force at the responsible body, for example dsb.gv.at, nis.gv.at or enisa.europa.eu.

From the term to practice

Where does your business actually stand?

The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT. The first call takes 20 minutes and carries no charge.

Book a first call

How secure is your IT really?

The IT Check reviews your IT across 8 areas with more than 100 checks. Findings within two weeks, from 1,299 € excl. VAT.

Book or message +43 677 61421703