Cyber Resilience Act

Article 1 Subject matter

The regulation establishes rules for placing products with digital elements on the market that ensure cybersecurity, sets essential cybersecurity requirements for design and development, mandates vulnerability handling processes during expected product use, and establishes market surveillance and enforcement procedures.

Article 2 Scope

Article 3 Definitions

Article 3 defines technical and operational terms including products with digital elements, software, hardware, components, electronic information systems, and economic operators (manufacturers, importers, distributors, authorised representatives); consumer and enterprise sizes, support periods for vulnerability handling, market-related concepts (placing and making available on the market, intended and foreseeable use), conformity assessment procedures, substantial modification, and CE marking; and regulatory, standards-related and cybersecurity concepts including risk assessment, vulnerability types, software bills of materials, incident-related terms, open-source software steward responsibilities, personal data, and CSIRT coordinator designations.

Article 4 Free movement

Member States must not block compliant products with digital elements from the market. Non-compliant products may be shown at exhibitions or events if clearly marked as not ready for market, and unfinished software may be temporarily made available for testing with visible marking, except for safety components covered by other Union laws.

Article 5 Procurement or use of products with digital elements

Member States may impose additional cybersecurity requirements for procuring or using products with digital elements for specific purposes, including national security, if necessary and proportionate and consistent with Union law. When procuring such products, Member States must consider compliance with core cybersecurity requirements and manufacturers' ability to manage vulnerabilities.

Article 6 Requirements for products with digital elements

Products with digital elements may only be sold if they meet the core cybersecurity requirements in Annex I Part I when properly installed, maintained, used for intended purposes or reasonably foreseeable conditions, and with security updates applied, and if the manufacturer's processes comply with Part II requirements.

Article 7 Important products with digital elements

Products with core functions listed in Annex III are classified as important and subject to conformity assessment; these either perform functions critical to cybersecurity of other systems and networks or perform functions carrying significant risk of adverse effects through manipulation. The Commission may update Annex III with a minimum 12-month transitional period, and must issue technical descriptions by 11 December 2025.

Article 8 Critical products with digital elements

The Commission may require critical products with digital elements from Annex IV to obtain a European cybersecurity certificate at 'substantial' assurance level or higher under an adopted scheme, with minimum 6-month transition periods unless urgent grounds apply. Critical products are those on which essential entities critically depend or where vulnerabilities could disrupt critical supply chains across the internal market.

Article 9 Stakeholder consultation

When implementing this Regulation, the Commission must consult Member State authorities, private sector undertakings including small enterprises, open-source communities, consumer associations, academia, and Union bodies about guidance, technical descriptions, category updates, and market impact assessments. The Commission must organize at least one annual consultation session.

Article 10 Enhancing skills in a cyber resilient digital environment

Member States, with Commission support where appropriate, shall develop cybersecurity skills and ensure sufficient skilled professionals to support market surveillance and conformity assessment, and promote collaboration between private sector, public administrations, training providers, and consumers to expand cybersecurity job opportunities.

Article 11 General product safety

Specific chapters of the General Product Safety Regulation apply to products with digital elements regarding risks not covered by this Regulation and where no other Union harmonisation legislation provides specific safety requirements.

Article 12 High-risk AI systems

Products with digital elements that are high-risk AI systems under EU Regulation 2024/1689 comply with cybersecurity requirements if they meet essential requirements in Annex I Part I, their manufacturing processes meet Annex I Part II, and their conformity is declared in an EU declaration. Notified bodies competent for high-risk AI systems under Regulation 2024/1689 are also competent to assess conformity with this Regulation. Important products in Annex III and critical products in Annex IV that are high-risk AI systems and subject to internal control conformity assessment shall instead follow this Regulation's procedures regarding cybersecurity requirements.

Article 13 Obligations of manufacturers

Manufacturers must design, develop and produce products with digital elements according to essential cybersecurity requirements, assess cybersecurity risks considering intended purpose and foreseeable use (documenting and updating assessments during a defined support period), exercise due diligence when integrating third-party and open-source components, report and remediate identified vulnerabilities to component maintainers, document cybersecurity aspects systematically, and implement coordinated vulnerability disclosure policies and ensure security updates remain available. The Commission may adopt delegated acts to specify minimum support periods by product category; manufacturers may ensure compliance for only the latest substantially modified software version if users of previous versions have free access without additional hardware or software costs. From market placement through the support period, manufacturers must immediately take corrective action or withdraw products if they know or should know they do not meet requirements, provide information to market surveillance authorities in an understandable language, and notify those authorities and users if ceasing operations.

Article 14 Reporting obligations of manufacturers

Manufacturers must notify any actively exploited vulnerability and any severe incident affecting product security simultaneously to the designated CSIRT coordinator and ENISA via a single reporting platform, with an early warning within 24 hours of awareness, a notification within 72 hours unless already provided (vulnerability notification and incident notification respectively), and a final report within 14 days of a corrective measure's availability (for vulnerabilities) or one month (for incidents). Manufacturers must report to the CSIRT coordinator in the Member State where their largest importer, distributor, or user base is located, and must inform affected users timely, in machine-readable format where appropriate; if they fail to do so, CSIRTs may inform users when necessary and proportionate. The Commission will adopt delegated acts by 11 December 2025 to specify conditions for delaying notification dissemination on cybersecurity grounds, and may issue implementing acts to specify notification formats and procedures.

Article 15 Voluntary reporting

Manufacturers and other entities may voluntarily report vulnerabilities and cyber threats to a CSIRT coordinator or ENISA, and may report incidents and near misses on the same voluntary basis; CSIRTs may prioritise mandatory over voluntary notifications. When non-manufacturers report actively exploited vulnerabilities or severe incidents, the CSIRT must promptly inform the manufacturer. CSIRTs and ENISA must protect confidential information and ensure that voluntary reporting does not impose additional obligations or liability on reporters.

Article 16 Establishment of a single reporting platform

ENISA shall establish and maintain a single reporting platform with electronic notification end-points for Member States and ENISA; the initial CSIRT must promptly disseminate notifications to coordinators in territories where the product is available, but may delay based on justified cybersecurity grounds including coordinated vulnerability disclosure, and in particularly exceptional circumstances involving active exploitation in one Member State, threats to essential interests, or imminent high risk, only limited information shall be made available until full dissemination unless ENISA recommends full dissemination due to systemic risk. CSIRTs must provide notified information on actively exploited vulnerabilities and severe incidents to their Member States' market surveillance authorities, and ENISA must take appropriate technical, operational and organisational measures to secure the platform and notify the CSIRTs network and Commission of security incidents; ENISA shall cooperate with the CSIRTs network to provide specifications for secure establishment, maintenance and operation including protocols for sharing vulnerabilities without corrective measures on a need-to-know basis.

Article 17 Other provisions related to reporting

ENISA may share incident notifications with the EU cyber crisis network if relevant for managing large-scale cybersecurity incidents, and may require public disclosure where necessary to prevent or mitigate severe incidents or where in the public interest. ENISA must submit a technical report every 24 months analysing emerging cybersecurity risk trends from notifications to the Cooperation Group and incorporate findings into its union-wide cybersecurity report. Notification itself creates no increased liability for notifying parties, and ENISA may add publicly known vulnerabilities to the European vulnerability database once fixes are available.

Article 18 Authorised representatives

Article 19 Obligations of importers

Importers must only distribute products with digital elements that meet essential cybersecurity requirements in Part I of Annex I and whose manufacturer's processes comply with Part II of Annex I, verifying before distribution that the manufacturer has performed conformity assessment, prepared technical documentation, applied CE marking, and provided the EU declaration of conformity and user instructions in an easily understood language. If importers know or suspect non-compliance, they must immediately take corrective action or withdraw or recall the product, inform the manufacturer of vulnerabilities promptly, and notify market surveillance authorities if a significant cybersecurity risk exists. Importers must retain the EU declaration of conformity for at least 10 years or the support period, whichever is longer, and must provide requested documentation and cooperate with market surveillance authorities.

Article 20 Obligations of distributors

Distributors must exercise due care regarding compliance requirements when making products available on the market and must verify that the CE mark is present and that manufacturers and importers have provided necessary documents. If distributors suspect non-compliance or significant cybersecurity risk, they must withhold the product until it conforms and must notify the manufacturer and market surveillance authorities.

Article 21 Cases in which obligations of manufacturers apply to importers and distributors

An importer or distributor becomes a manufacturer and must comply with manufacturer obligations if it places a product under its own name or trademark or if it substantially modifies a product already on the market.

Article 22 Other cases in which obligations of manufacturers apply

Any person other than the manufacturer, importer or distributor who substantially modifies a product with digital elements and makes it available on the market is considered a manufacturer and must comply with manufacturer obligations for the affected parts or, if the modification impacts overall cybersecurity, for the entire product.

Article 23 Identification of economic operators

Economic operators must provide market surveillance authorities with the names and addresses of their suppliers and customers upon request, and must retain this information for 10 years from both the date they received and supplied each product.

Article 24 Obligations of open-source software stewards

Open-source software stewards must establish and document a cybersecurity policy for secure development and vulnerability handling, must cooperate with market surveillance authorities, and must provide requested documentation in an easily understood language. They must also comply with severe incident reporting obligations to the extent they are involved in product development or operate development infrastructure.

Article 25 Security attestation of free and open-source software

The Commission may adopt delegated acts to establish voluntary security attestation programmes allowing developers or users of open-source products to demonstrate conformity with essential cybersecurity requirements, facilitating due diligence by manufacturers integrating such components.

Article 26 Guidance

The Commission must publish guidance to help economic operators apply the regulation, with emphasis on microenterprises and small and medium-sized enterprises, covering the regulation's scope, support periods, relationships to other EU legislation, and the concept of substantial modification. The Commission must also maintain a list of delegated and implementing acts and consult stakeholders when preparing guidance.

Article 27 Presumption of conformity

Digital element products meeting published harmonised standards are presumed compliant with essential cybersecurity requirements in Annex I. The Commission may establish implementing acts with common specifications if standardisation organisations reject requests, miss deadlines, fail to deliver compliant standards, or no harmonised standard references are published or expected soon, and products following such implementing acts are presumed compliant with the corresponding requirements; when a harmonised standard is later published, the Commission shall repeal the related implementing act. Products holding valid EU statements of conformity or certificates under European cybersecurity certification schemes are presumed compliant with covered requirements, with substantial assurance level certificates eliminating third-party assessment obligations for corresponding requirements.

Article 28 EU declaration of conformity

Manufacturers must draw up an EU declaration of conformity stating they have demonstrated fulfilment of applicable essential cybersecurity requirements, using the model structures in Annexes V or VI, with specified elements from Annex VIII, and in required Member State languages. A single declaration covers all applicable Union legal acts; manufacturers assume responsibility for product compliance when drawing it up.

Article 29 General principles of the CE marking

The CE marking must follow general principles set out in Regulation (EC) No 765/2008.

Article 30 Rules and conditions for affixing the CE marking

CE marking must be affixed visibly, legibly and indelibly on the product, packaging or accompanying declaration, or for software on the declaration or easily accessible website section. The marking height may be below 5 mm if still visible and legible, may be followed by pictograms indicating special risks, and must precede market placement; notified body identification numbers are added where applicable. Member States ensure correct application, and the Commission may establish technical specifications for labels and pictograms by implementing acts.

Article 31 Technical documentation

Manufacturers must prepare technical documentation detailing how their product and processes comply with essential cybersecurity requirements, containing elements specified in Annex VII, before placing on the market and continuously updating it at least throughout the support period. Documentation shall be drawn up in an official Member State language or one acceptable to the notified body.

Article 32 Conformity assessment procedures for products with digital elements

Manufacturers must perform conformity assessment of products with digital elements using internal control, EU-type examination followed by conformity to type, full quality assurance, or European cybersecurity certification schemes. Class I important products not fully complying via harmonised standards or certification schemes at 'substantial' assurance level must use EU-type examination or full quality assurance; class II important products may use EU-type examination, full quality assurance, or European certification schemes at 'substantial' level. Critical products listed in Annex IV must demonstrate conformity using European cybersecurity certification schemes, or if those conditions are not met, using procedures for class II products.

Article 33 Support measures for microenterprises and small and medium-sized enterprises, including start-ups

Member States should organise awareness-raising and training on this Regulation, establish dedicated communication channels for microenterprises and small enterprises, and support their testing and conformity assessment. Member States may create cyber resilience regulatory sandboxes providing controlled testing environments for innovative products before market placement, supervised by market surveillance authorities and promoted to small enterprises. The Commission shall provide implementation guidance and advertise available financial support.

Article 34 Mutual recognition agreements

Article 35 Notification

Member States must inform the Commission and each other of authorised conformity assessment bodies. Member States shall endeavour to ensure by 11 December 2026 that sufficient notified bodies exist in the Union to conduct assessments and prevent market entry obstacles.

Article 36 Notifying authorities

Each Member State must designate a notifying authority responsible for assessing, designating, notifying and monitoring conformity assessment bodies. Member States may delegate these tasks to national accreditation bodies or other legal entities, which must then comply with requirements for notifying authorities and have liability arrangements; the notifying authority retains full responsibility.

Article 37 Requirements relating to notifying authorities

Notifying authorities must avoid conflicts of interest with conformity assessment bodies, operate objectively and impartially, have decisions on notification taken by different persons than those who performed the assessment, not offer commercial activities that assessment bodies provide, safeguard confidentiality, and maintain sufficient competent personnel.

Article 38 Information obligation on notifying authorities

Member States must inform the Commission of their procedures for assessing, notifying and monitoring conformity assessment bodies and any changes. The Commission must make this information publicly available.

Article 39 Requirements relating to notified bodies

Notified bodies must be legally established, independent third parties, with management and personnel that are not designers, developers, manufacturers, suppliers, importers, distributors, installers, purchasers, owners, users, maintainers or representatives of assessed products, nor engage in conflicting activities including consultancy for those products; they must ensure subsidiaries and subcontractors do not compromise confidentiality, objectivity or impartiality, and must carry out assessments with highest professional integrity and technical competence, free from pressures. Notified bodies must have documented, transparent and reproducible conformity assessment procedures that distinguish assessment tasks from other activities and adjust to undertaking size, sector, structure, product complexity and production type; assessment personnel must have appropriate technical training, cybersecurity knowledge and harmonised standards knowledge, with authority to conduct assessments and produce records; their pay must not depend on assessment quantity or results, and they must maintain professional secrecy.

Article 40 Presumption of conformity of notified bodies

A conformity assessment body that meets published harmonised standards is presumed to comply with the requirements for notified bodies in so far as those standards cover those requirements.

Article 41 Subsidiaries of and subcontracting by notified bodies

Where notified bodies subcontract assessment tasks or use subsidiaries, they must ensure subcontractors and subsidiaries meet the requirements for notified bodies, take full responsibility for work performed by them, and keep relevant qualification and work documentation available to the notifying authority. Subcontracting and subsidiary work may only proceed with the manufacturer's agreement.

Article 42 Application for notification

Conformity assessment bodies must apply for notification to the notifying authority in their Member State, providing descriptions of assessment activities, procedures and products with digital elements they claim to cover. Applications must include an accreditation certificate from a national accreditation body or, where unavailable, all documentary evidence necessary to verify compliance with notified body requirements.

Article 43 Notification procedure

Notifying authorities must notify only qualified assessment bodies using the Commission's information system, providing full activity and competence details. Bodies begin performing notified functions only if the Commission and other Member States raise no objections within two weeks for accredited bodies or two months for unaccredited ones, and must notify changes to notifications.

Article 44 Identification numbers and lists of notified bodies

The Commission assigns a single identification number to each notified body even when notified under multiple Union legal acts, and shall maintain and publicly update a list of bodies notified under this Regulation including their identification numbers and notified activities.

Article 45 Changes to notifications

Article 46 Challenge of the competence of notified bodies

The Commission investigates cases where it questions a notified body's competence or continued capability to meet requirements. Notifying Member States provide information upon request, and if the Commission finds non-compliance, it instructs the notifying Member State to take corrective action including de-notification if needed; sensitive information remains confidential.

Article 47 Operational obligations of notified bodies

Notified bodies must conduct conformity assessments according to specified procedures in a proportionate manner, considering undertaking size and cybersecurity risk level while maintaining required rigour and protection. Where manufacturers fail to meet requirements or products become non-compliant, bodies must require corrective measures and suspend, withdraw or restrict certificates as appropriate, and shall not issue certificates if non-compliance is found.

Article 48 Appeal against decisions of notified bodies

Member States must make available an appeal procedure against notified body decisions.

Article 49 Information obligation on notified bodies

Notified bodies must report to their notifying authority any refusal, restriction, suspension or withdrawal of their certificate; circumstances affecting their notification scope or conditions; requests for information from market surveillance authorities; and on request, details of their conformity assessment activities including cross-border work and subcontracting. Notified bodies must also share relevant information with other similarly notified bodies about negative conformity assessment results and positive results upon request.

Article 50 Exchange of experience

Article 51 Coordination of notified bodies

The Commission must ensure appropriate coordination and cooperation between notified bodies through a cross-sectoral group. Member States must ensure their notified bodies participate in this group directly or through designated representatives.

Article 52 Market surveillance and control of products with digital elements in the Union market

Regulation 2019/1020 applies to products with digital elements; each Member State must designate market surveillance authorities to supervise compliance and may require corrective actions. The Commission facilitates experience exchange and cooperation among authorities and stakeholders; authorities must inform consumers of complaint and vulnerability reporting mechanisms, report annually, and work with AI Regulation authorities for high-risk AI systems, with ADCO established for uniform application. Market surveillance authorities shall check manufacturers' support period determinations, and ADCO must publicly release statistics on product categories and average support periods, plus offer guidance on typical durations; ADCO may recommend that authorities prioritize reviewing categories with insufficient support periods.

Article 53 Access to data and documentation

Market surveillance authorities may request access to data and internal documentation from manufacturers necessary to assess conformity with essential cybersecurity requirements, including information on design, development, production and vulnerability handling, provided in an easily understood language.

Article 54 Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk

If an economic operator fails to take adequate corrective action within the set deadline, the market surveillance authority must impose provisional measures to prohibit, restrict, withdraw or recall the product from the national market, and notify the Commission and other Member States without delay. The notification must include identification details, origin, nature of non-compliance, risk description, measures taken, and whether non-compliance stems from failure to meet essential cybersecurity requirements or shortcomings in standards or certification schemes. Other Member States must inform the Commission of their own measures and any disagreement; if no objection is raised within three months, the provisional measure is deemed justified.

Article 55 Union safeguard procedure

If a Member State objects to another Member State's measure within three months, or the Commission considers it contrary to Union law, the Commission must consult the Member State and economic operator and decide within nine months whether the measure is justified. If justified, all Member States must withdraw the non-compliant product from their markets; if unjustified, the Member State must withdraw the measure. When non-compliance stems from shortcomings in harmonised standards, the Commission applies standard-setting procedures; when it stems from shortcomings in certification schemes or common specifications, the Commission may amend or repeal relevant delegated or implementing acts.

Article 56 Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk

When the Commission has sufficient reason to consider a product with digital elements presents significant cybersecurity risk and does not comply with this Regulation, it must inform market surveillance authorities, which then apply the national and safeguard procedures. If the Commission considers the product presents significant risk due to non-technical factors, it must inform market surveillance authorities and may consult relevant authorities under NIS Directive and the Cooperation Group. In urgent circumstances where the product remains non-compliant and national measures are ineffective, the Commission may evaluate compliance, request ENISA analysis, and adopt implementing acts for corrective or restrictive measures including market withdrawal or recall within a reasonable period, subject to consultation with Member States and economic operators.

Article 57 Compliant products with digital elements which present a significant cybersecurity risk

A market surveillance authority must require corrective action (ensuring the product no longer presents relevant risks, withdrawal from market, or recall) where a compliant product with digital elements presents significant cybersecurity risk threatening health, safety, fundamental rights, essential entity service availability or integrity, or other public interest; the manufacturer must comply throughout the Union within the set timeline. Where the Commission has sufficient reason to believe such risks exist, it may request the market surveillance authority to evaluate the product and apply non-compliance procedures, or in urgent circumstances with ineffective national measures, evaluate the risks itself and request ENISA analysis. Based on evaluation, the Commission may adopt implementing acts for corrective or restrictive measures including market withdrawal or recall within a reasonable period, following consultation with Member States and economic operators.

Article 58 Formal non-compliance

A market surveillance authority must require a manufacturer to resolve findings such as improper or missing CE marking, incorrect or missing EU declarations of conformity, missing notified body identification numbers, or incomplete or unavailable technical documentation. If the non-compliance persists, the Member State shall restrict or prohibit the product from the market or ensure its withdrawal or recall.

Article 59 Joint activities of market surveillance authorities

Market surveillance authorities may coordinate with other relevant authorities to conduct joint activities for cybersecurity and consumer protection regarding specific products with digital elements, particularly those presenting cybersecurity risks. The Commission or ENISA may propose joint activities to check compliance across multiple Member States. These authorities must ensure such agreements do not create unfair competition or compromise their objectivity, independence and impartiality, and must make agreements and participant names publicly available.

Article 60 Sweeps

Market surveillance authorities shall conduct simultaneous coordinated inspections of particular products with digital elements to verify compliance or detect violations, potentially including purchases under false identity. The Commission typically coordinates these sweeps and may publish aggregated results. ENISA may propose sweep categories based on notifications, and participating authorities may use investigation powers and allow Commission officials to attend.

Article 61 Exercise of the delegation

The Commission receives power to adopt delegated acts for specified articles for five years from 10 December 2024, with automatic tacit renewal for identical periods unless the European Parliament or Council objects within three months of each period's end. Either institution may revoke this power at any time. The Commission must consult Member State experts, notify both institutions upon adoption, and delegated acts enter into force only if neither institution objects within two months of notification, or if both inform the Commission they will not object.

Article 62 Committee procedure

The Commission is assisted by a committee under Regulation (EU) No 182/2011. For written procedure opinions, the procedure terminates without result if the chair or any committee member decides or requests this within the specified deadline.

Article 63 Confidentiality

All parties applying this Regulation must protect the confidentiality of obtained information to guard intellectual property rights, confidential business information or trade secrets, effective implementation, public and national security, and criminal or administrative proceedings. Confidential information exchanged between market surveillance authorities and the Commission requires prior consent from the originating authority before disclosure. These obligations do not restrict rights regarding warning dissemination or information provision under Member State criminal law, and the Commission and Member States may exchange sensitive information with third countries under adequate bilateral or multilateral confidentiality arrangements.

Article 64 Penalties

Member States must establish effective, proportionate and dissuasive penalty rules for violations and notify the Commission. Non-compliance with Articles 18 to 23, 28, 30(1)-(4), 31(1)-(4), 32(1)-(3), 33(5), 39, 41, 47, 49 and 53 incurs fines up to EUR 10 million or 2% of annual turnover. Administrative fines do not apply to microenterprises or small enterprises failing to meet notification deadlines in Articles 14(2)(a) or 14(4)(a), nor to violations by open-source software stewards.

Article 65 Representative actions

Directive 2020/1828 applies to representative actions against manufacturers for breaching this Regulation in ways that cause or could cause harm to collective consumer interests.

Article 66 Amendment to Regulation (EU) 2019/1020

Adds this Regulation to the list in Annex I to the market surveillance regulation.

Article 67 Amendment to Directive (EU) 2020/1828

Adds this Regulation to the list in Annex I to the consumer protection representative actions directive.

Article 68 Amendment to Regulation (EU) No 168/2013

Adds protection of two- or three-wheel vehicles and quadricycles against cyberattacks as an approval requirement to the vehicle regulation.

Article 69 Transitional provisions

Article 70 Evaluation and review

Article 71 Entry into force and application

The Regulation enters into force twenty days after publication in the Official Journal. It applies from 11 December 2027, except that Article 14 applies from 11 September 2026 and Chapter IV applies from 11 June 2026. The Regulation is binding and directly applicable in all Member States.