Law and standards
Cyber Resilience Act
What is the Cyber Resilience Act?
The Cyber Resilience Act, Regulation (EU) 2024/2847, sets security requirements for products with digital elements. It addresses those who bring such products to market: manufacturers, importers and distributors.
For most businesses the most important point is a reassuring one. Anyone who merely uses software is not placed under duties by the regulation. The duties fall on the economic operators who make a product available.
Care is needed where that line blurs. Anyone who sells a bought in product under their own name or trademark counts as a manufacturer under Article 21. The same applies under Article 22 where a product is substantially modified and then made available. Businesses that pass on devices or software carrying their own logo should have this examined.
On the dates. The regulation entered into force on 10 December 2024. The reporting duties of manufacturers for actively exploited vulnerabilities and severe incidents under Article 14 apply from 11 September 2026. The remaining duties apply from 11 December 2027. This is our interpretation of the regulation and not legal advice.
All terms in the knowledge base
Legal notice: We are engineers, not lawyers: we cannot and will not make any statements on legal questions. This entry is purely technical, reflects the state of knowledge to the best of our understanding, and is not legal advice; it does not replace review by a qualified lawyer. No guarantee is given as to correctness or completeness; liability arising from the use of this information is excluded to the extent permitted by law. What counts is always the version currently in force at the responsible body, for example dsb.gv.at, nis.gv.at or enisa.europa.eu. AI transparency: parts of this entry may have been created with AI assistance, so errors are possible despite review: please report errors here · how we create content.
From the term to practice
Where does your business actually stand?
The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT.
office [at] vetosec [dot] at · vetosec.at/contact/
