EU Cyber Resilience Act 2026: What Connected Hardware Founders Should Build Into the Prototype Now

Short answer: Regulation (EU) 2024/2847 (the Cyber Resilience Act) covers hardware and software "products with digital elements" made available on the EU market, including final products and components. It entered into force on 10 December 2024.

Main obligations apply from 11 December 2027. Chapter IV (notification of conformity assessment bodies) applies from 11 June 2026. Article 14 reporting obligations apply from 11 September 2026.

For connected-hardware founders, secure-by-design choices (unique device identity, signed OTA, vulnerability disclosure channel, SBOM and component diligence) belong in early architecture and the functional prototype, not after enclosure freeze.

The European Commission summarizes Regulation (EU) 2024/2847 as a horizontal framework for hardware and software products with digital elements made available on the Union market. That includes final products and components placed separately on the market.

Products fall in scope when they are made available on the market and their intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.

Manufacturer duties (as summarized by the Commission) include a cybersecurity risk assessment during design, development, and production. Due diligence on third-party components. Technical documentation. Conformity assessment. An EU Declaration of Conformity; CE marking. And user information that includes the end date of the support period (month and year).

Related reading: IoT idea development, IoT security, and IoT developer guidance.

After placing a product on the market, manufacturers must notify actively exploited vulnerabilities and severe incidents affecting product security via the CRA Single Reporting Platform (to the relevant CSIRT and ENISA): an early warning within 24 hours, a main notification within 72 hours, then final reports on the timelines in the Commission summary (including a final report no later than 14 days after a corrective or mitigating measure is available for actively exploited vulnerabilities, and within one month from the 72-hour submission for severe incidents).

Reporting obligations apply to products already made available on the Union market, including those placed before 11 December 2027. The full product conformity regime still starts on 11 December 2027 (with transitional notes in the Commission summary). Products placed before that date are generally subject to the CRA after that date only if they undergo a substantial modification, while reporting still reaches products already on the market.

Run this once per connected-hardware program and keep answers with the design file. These are engineering sequencing prompts, not a compliance certificate.

Unique identity, signed OTA, disclosure channels, and component diligence change architecture, PCB options, antenna and debug ports, and sometimes the housing. Waiting until after enclosure freeze turns a documentation task into a redesign.

Soft brand note from LA NPDT: treat these as idea-to-functional-prototype decisions, the same way you would treat DFM for a critical interface.

See also regulatory-compliant design guidance and engineering for global markets.

If you are still proving the connected concept, design identity, update trust, and component diligence into the functional prototype rather than around them later. If you are already quoting tooling, freeze the enclosure only after a security-minded design review. Book a consult with LA NPDT when you want an engineering-side walkthrough of prototype sequencing for EU-bound connected hardware. This article is not legal advice.