ZEPHIR

Cyber Resilience Act: what is changing for manufacturers of connected products

6 min read

Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities. The other obligations follow in 2026 and 2027.

A three-stage schedule

The European Cyber Resilience Act applies in stages. Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and serious incidents affecting their products, with an initial alert within 24 hours followed by notification within 72 hours.

Notified bodies responsible for assessing certain products may be designated from 11 December 2026. The main provisions of the regulation apply from 11 December 2027.

Who this concerns

The legislation covers manufacturers of products with digital elements placed on the European market: programmable logic controllers, connected sensors, software-controlled industrial equipment, gateways and embedded software.

It does not apply to all industrial incidents. It concerns the safety of the products themselves throughout their life cycle.

The needs this creates

The manufacturers concerned must organise vulnerability management, document the security of their products and, for certain categories, undergo a conformity assessment.

This creates projects for industrial cybersecurity specialists, vulnerability management software providers, testing laboratories and compliance consultancies.

What this changes for suppliers

The manufacturers concerned can be identified: they place connected equipment on the market. Their technical and quality departments must act before December 2027. Now is the right time to start a dialogue.

Let's discuss your growth.

We are a commercial growth firm serving industrial companies and their ecosystems. Our role is to understand your offering, define the accounts to target and arrange discussions with their decision-makers.

An initial 30-minute discussionNo commitment. We will respond within 48 working hours.

Firm overview · PDFTo share with your management team.Download

Confidential discussion. Response within 48 business hours.