Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities. The other obligations follow in 2026 and 2027.
A three-stage schedule
The European Cyber Resilience Act applies in stages. Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and serious incidents affecting their products, with an initial alert within 24 hours followed by notification within 72 hours.
Notified bodies responsible for assessing certain products may be designated from 11 December 2026. The main provisions of the regulation apply from 11 December 2027.
Who this concerns
The legislation covers manufacturers of products with digital elements placed on the European market: programmable logic controllers, connected sensors, software-controlled industrial equipment, gateways and embedded software.
It does not apply to all industrial incidents. It concerns the safety of the products themselves throughout their life cycle.
The needs this creates
The manufacturers concerned must organise vulnerability management, document the security of their products and, for certain categories, undergo a conformity assessment.
This creates projects for industrial cybersecurity specialists, vulnerability management software providers, testing laboratories and compliance consultancies.
What this changes for suppliers
The manufacturers concerned can be identified: they place connected equipment on the market. Their technical and quality departments must act before December 2027. Now is the right time to start a dialogue.
Target account development Reach decision-makers at target companies.
New market entry Test a sector before investing in it.
International expansion First customers in a new country.
Launching a new offering Measure market interest in a product.
Commercial opportunities programme Qualified meetings every week for 90 days.
Signal-based outreach Engage when the need arises.
Trade shows and events A full schedule before the trade show opens.
Account reactivation Reconnect with lost accounts.
Eleven industry groups
Nine engagements, from situation to outcome
Regulations and markets
Firm presentation
A commercial growth firm

