Cyber Resilience Act: obligations, deadlines and what changes for cyber insurance

Fact sheet updated to 1 November 2026 on Regulation (EU) 2024/2847 (Cyber Resilience Act): which products are in scope, reporting of exploited vulnerabilities in force since 11 September 2026, security requirements from 11 December 2027, fines and what it means for cyber, tech E&O and product liability policies.

Regulatory fact sheet · updated 1 November 2026 · by cybercoverinsurance

Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), sets cybersecurity requirements for products with digital elements sold in Europe: hardware and software, from routers to apps, from industrial sensors to business software (Hogan Lovells). NIS2 and DORA look at those who use technology; the CRA looks at those who make it.

For those who take on risk, the CRA matters because it moves security upstream in the supply chain. A maker of software or connected devices will have to show it designed secure products and fixes their vulnerabilities for years. From 9 December 2026, under the new Product Liability Directive, a product that does not meet CRA requirements will also be easier to treat as defective.

In the text, "Article" means a binding rule; "recital" means one of the introductory paragraphs that explain how to read it.

Who is in scope

The CRA applies to manufacturers, importers and distributors of products with digital elements, meaning hardware and software that connect, directly or indirectly, to a device or a network. Products already covered by sector rules, such as medical devices, vehicles and aircraft, are excluded, as are purely online services (SaaS), which may fall under NIS2 instead.

The main obligations fall on the manufacturer, including when it is based outside the EU. Free software developed outside a commercial activity is not covered; organisations that support open source projects used commercially on a lasting basis ("stewards") have lighter obligations.

The main obligations

Reporting vulnerabilities and incidents (since 11 September 2026)

Since 11 September 2026 manufacturers must report every actively exploited vulnerability and every severe incident affecting the security of the product (Article 14) (European Commission):

early warning within 24 hours of becoming aware;
notification within 72 hours;
final report within 14 days of a fix being available, for vulnerabilities, or within one month of the notification, for severe incidents.

Reports go through ENISA's single reporting platform, live since 11 September 2026, which forwards them to the competent national CSIRT (ENISA). The obligation also covers products already on the market before 2027, and the manufacturer must inform affected users (Hogan Lovells).

Security requirements (from 11 December 2027)

From 11 December 2027 products placed on the market must meet essential security requirements by design: no known exploitable vulnerabilities at the time of sale, secure default configuration, security updates for the whole support period, and vulnerability management with a software bill of materials. A compliant product carries the CE marking. Certain categories of important or critical products need a conformity assessment by a third-party body.

Support period

The manufacturer must state how long it will provide security updates. The period must reflect the expected use of the product and is normally at least five years.

Fines

Article 64 sets three levels: up to 15 million euros or 2.5% of worldwide turnover for breaches of the essential requirements and reporting obligations; up to 10 million or 2% for other obligations; up to 5 million or 1% for incorrect information given to authorities. Market surveillance authorities can also order a product to be withdrawn or recalled.

Deadlines

10 December 2024: entry into force;
11 June 2026: rules on conformity assessment bodies;
11 September 2026: reporting of exploited vulnerabilities and severe incidents;
11 December 2027: full application, including essential requirements and the obligations of open source stewards.

What changes for cyber insurance

Supply chain. The CRA is the first law that requires technology suppliers to fix vulnerabilities and report them within 24 hours. For a cyber portfolio it will reduce over time the risk from unpatched components, but only for new products: the installed base will stay exposed for years.

Producer liability. A maker of software or devices that does not comply with the CRA risks fines, market withdrawals and, under the Product Liability Directive, damages claims that are easier for claimants to win. The risk moves to tech E&O and product liability, and the costs of recalling an insecure product are not covered by every policy.

Reporting. The 24-hour early warning adds to NIS2's 24 hours and, in the financial sector, to DORA's 4 hours. A manufacturer that is also a NIS2 entity may have two separate reports for the same event. The policy's incident response service must be able to handle both.

Underwriting information. The CRA produces useful documents: software bill of materials, vulnerability handling policy, declared support period, reporting history. For insureds that use third-party technology, knowing whether their main suppliers comply with the CRA helps assess supply chain aggregation.

Impact for insurersMedium

The CRA makes security of digital products and rapid vulnerability reporting mandatory, but the requirements apply only to products sold from December 2027 and the effect on claims will be gradual.