Cyber Resilience Act IoT: 7 Must-Know Duties for Makers
Cyber Resilience Act IoT rules stopped being a future problem on 11 September 2026. From that day, anyone selling a connected product in the EU has had to report actively exploited vulnerabilities and severe incidents, and the first deadline is 24 hours.
This guide from IoT Insights Hub sets out what the Act covers, the dates that matter, seven duties for makers, the reporting clock, the fines and the criticism. We read the Commission’s pages and the regulation text, and we say where a source is commentary or a news report.
Not legal advice, just a plain-English map. Already building secure devices? Our guide to IoT security risks and how to fix them covers the technical side.
What does the Cyber Resilience Act IoT rule set cover?
The Cyber Resilience Act, Regulation (EU) 2024/2847, sets mandatory cybersecurity rules for “software or hardware products with digital elements” sold in the EU. That covers connected devices such as baby monitors and smart watches, plus apps and programs. Manufacturers must build, maintain and report on security across the product’s life.
The European Commission says the duties apply at every stage of the value chain and that national market surveillance authorities enforce them. Compliant products carry the CE marking, and some products of particular cybersecurity relevance need a third-party assessment by a notified body before sale.
Who is in scope? Any connectable product sold in the EU, including from makers based elsewhere. TechTimes reports that non-EU manufacturers are covered and must name an authorised EU representative, which fits Article 64, since it lists authorised representatives among the roles that can be fined. The same report says reporting also reaches products already on the market, a point a commentary site, cyberresilienceact.eu, ties to Article 69(3).
The Commission published non-binding guidance on 27 July 2026, with 67 practical examples, flowcharts and graphs. It explains when remote data processing and free and open source software fall in scope, what counts as a “substantial modification” and how support periods work. It pays particular attention to microenterprises and SMEs.
For a wider picture of what these devices do, see our beginner guide to IoT. For the wired industrial side, where exposed controllers raise similar worries, read what is Modbus.
When do the Cyber Resilience Act IoT deadlines apply?
The Act entered into force on 10 December 2024. Reporting obligations began on 11 September 2026, and the main obligations, including secure-by-design duties, CE marking and conformity assessment, apply from 11 December 2027. The Commission published practical guidance on 27 July 2026 to help manufacturers prepare.
| Date | What happened or applies | Source |
|---|---|---|
| 10 Dec 2024 | Act entered into force | European Commission |
| 11 Dec 2025 | Delegated act adopted on when a CSIRT may delay passing on notifications | European Commission |
| 27 Jul 2026 | Non-binding practical guidance published | European Commission |
| 11 Sep 2026 | Reporting obligations began | European Commission |
| 11 Dec 2026 | Member States should strive to have enough notified bodies by this date (Article 35) | Regulation text, via cyberresilienceact.eu |
| 11 Dec 2027 | Main obligations apply | European Commission |
One small trap. Wikipedia lists the entry into force as 12 November 2024, while the Commission and EUR-Lex metadata say 10 December 2024. We use the Commission date, and Wikipedia itself flags parts of that page as needing updates.
The gap between 2026 and 2027 is where many teams will slip. Reporting is live now, but the design, documentation and conformity work has a year left. In IoT Insights Hub’s view, treating the first date as a dress rehearsal for the second is the safest reading.
What are the 7 Cyber Resilience Act IoT duties for makers?
The Act does not number its duties, so this list is IoT Insights Hub’s grouping of Articles 13 and 14: design security in, vet third-party components, handle vulnerabilities, support devices for five years, report exploited flaws, keep documentation including an SBOM, and complete CE marking and conformity steps.
Each duty below comes from the regulation text as reproduced by Springlex and cyberresilienceact.eu, checked against the Commission’s pages. Paragraph numbers differ between those two reproductions, so confirm exact wording on EUR-Lex before citing it.
- Design security in from the start. Article 13 says products must be designed, developed and produced to the essential cybersecurity requirements in Annex I, based on a documented risk assessment. That assessment must be updated during the support period, per the text on Springlex.
- Vet every third-party component. Manufacturers must exercise due diligence when they integrate components from others, including open-source ones, so those parts do not weaken the product. If you find a flaw in a component, report it to whoever maintains it.
- Handle vulnerabilities for the whole support period. Vulnerabilities must be handled effectively across the product’s support life, and cyberresilienceact.eu says that means working under a coordinated vulnerability disclosure policy. Fixing a bug before anyone exploits it counts as normal handling, not as an Article 14 report.
- Support the product for at least five years. Recital 60 says the support period should be no less than five years unless the product’s expected use is shorter. Security updates must stay available for at least 10 years after issue or the rest of the support period, whichever is longer, per Springlex.
- Report exploited vulnerabilities and severe incidents. From 11 September 2026, an actively exploited vulnerability or severe incident triggers a 24-hour early warning, a 72-hour notification and a final report, filed through ENISA’s Single Reporting Platform to the right national CSIRT.
- Keep the paperwork, including an SBOM. Technical documentation and the EU declaration of conformity must be kept for at least 10 years or the support period, whichever is longer, per cyberresilienceact.eu. The Act defines a software bill of materials, and recital 22 says authorities may request the SBOMs makers generate.
- Finish CE marking, conformity assessment and user instructions. Compliant products bear the CE marking, and the Commission says some products of particular cybersecurity relevance need a third-party assessment by a notified body. Products must also ship with the user information and instructions set out in Annex II.
Spot the pattern? Most of the work is paperwork and process, not new cryptography. That is good news for small teams, though it means someone must own the process. For how product design choices affect risk on the connectivity side, see our guides to what is MQTT and energy-efficient IoT protocols.
How does the CRA reporting clock work?
Under Article 14, a manufacturer must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, a fuller notification within 72 hours, and a final report. For vulnerabilities that is within 14 days of a fix being available. For incidents it is within one month.
| Stage | Timing | What it contains |
|---|---|---|
| Early warning | Within 24 hours of awareness | Alert that it happened; for incidents, whether malicious acts are suspected |
| Notification | Within 72 hours | Nature of the flaw or incident, first assessment, measures taken, advice for users |
| Final report: vulnerability | No later than 14 days after a fix is available | Full description, severity, impact and remediation |
| Final report: incident | Within one month of the 72-hour notification | Full description, severity, impact and remediation |
The timings come from the Commission’s reporting page. The contents column comes from cyberresilienceact.eu, a commentary site and not the legal text, so treat it as a guide.
Where does the report go? The Commission says it goes to the CSIRT in the Member State where the maker has its main establishment, with ENISA receiving it at the same time unless exceptional circumstances apply. ENISA runs the Single Reporting Platform under Article 16, and TechTimes reports it opened on 11 September as the only legally valid channel.
Two launch quirks are worth knowing. TechTimes and cyberresilienceact.eu both say there was no API at launch, so filing is manual through a web form. TechTimes also says voluntary reporting under Article 15 is deferred with no date. Platform details change fast, so check ENISA’s own pages before you build a process around them.
What counts as a trigger? The Commission names two things: actively exploited vulnerabilities and severe incidents that affect the security of the product. A flaw you patched before anyone exploited it falls under normal vulnerability handling, per cyberresilienceact.eu, not under this clock.
The 24-hour alert must reach a human fast. IoT Mail Bridge explains how to build reliable notification paths in its guide to a reliable SMTP relay for IoT and M2M fleet alerts, and how to stop teams ignoring them in its piece on IoT alert fatigue.
What are the penalties under the Cyber Resilience Act?
Article 64 sets three fine tiers. Breaching the essential security requirements or Articles 13 and 14 can cost up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Other breaches reach EUR 10 million or 2%, and misleading information to authorities reaches EUR 5 million or 1%.
| Tier | Up to | What it covers |
|---|---|---|
| 1 | EUR 15 million or 2.5% of turnover | Annex I essential requirements and the duties in Articles 13 and 14 |
| 2 | EUR 10 million or 2% of turnover | Other obligations, including authorised representatives, importers, distributors, declaration of conformity, CE marking and technical documentation |
| 3 | EUR 5 million or 1% of turnover | Incorrect, incomplete or misleading information given to notified bodies or authorities |
For undertakings, the higher of the two figures applies, per the Article 64 text on Springlex, and TechTimes reports the same amounts. Authorities must weigh the nature, gravity and duration of the breach and the size of the firm, with particular attention to microenterprises and SMEs, including start-ups.
Two exemptions matter. Paragraph 10 says the fines do not apply to micro or small enterprises for missing the 24-hour early-warning deadline, and they do not apply to infringements by open-source software stewards. The duty to report still applies, and Springlex notes a corrigendum corrected that paragraph on 2 July 2025.
Fines are one risk, and a smaller one for most firms. In IoT Insights Hub’s view, the likelier cost is a market surveillance authority pulling a non-compliant product, which also hits sales and trust.
What should IoT makers do this quarter?
Start with the 24-hour clock, because it is already live. Name an incident owner, confirm who files on the ENISA platform, check which products are in scope, and set a support end date for each. Then build the documentation, vulnerability intake and SBOM work needed before December 2027.
The Act is silent on how to organise this, so the list below is IoT Insights Hub’s practical view and not a legal requirement.
- Name an incident owner and a deputy, and give both access to the reporting platform before you need it. The commentary site says login uses EU Login with multi-factor authentication.
- List every product with digital elements you sell in the EU, including older models still on the market.
- If you are outside the EU, appoint an authorised representative.
- Write a vulnerability intake policy, so researchers know where to send a report and your team knows who triages it.
- Generate and store an SBOM for each release, since authorities may request it.
- Decide each product’s support end date and print it where buyers will see it.
- Run one drill: pretend a flaw is being exploited today and see how long a 24-hour early warning really takes.
Vendors will tell you this is a big project. For some it is. For a small team with a handful of devices, it is mostly a set of habits. Founders weighing the cost of compliance against growth can read The Business Perspective’s guide to raising seed funding.
A note for founders: investors increasingly ask about compliance. The Business Perspective tracks where money is going in its global startup funding report for September 2026 and its Q3 2026 venture funding analysis, which puts AI at 64% of funding in its headline finding.
What do critics say about the Cyber Resilience Act?
Critics raise four main worries: mandatory disclosure before a patch exists, burdens on open-source developers, unclear wording and a lack of preparation. Supporters point to one set of rules across the EU and to security duties across a product’s whole life. Both camps have a point, and several complaints date from earlier drafts.
- Pre-patch disclosure: per TechTimes, a 2023 coalition including Google, the Electronic Frontier Foundation, Rapid7, Bugcrowd, Trend Micro, ESET and the CyberPeace Institute warned that sending flaws to agencies before a fix exists could create a central map of unpatched vulnerabilities.
- Remediation risk: TechTimes paraphrases Katie Moussouris of Luta Security as arguing that agencies lack the skills to develop fixes and that early mandatory reporting could interfere with remediation.
- Partial answer: Article 14(9) lets a CSIRT delay passing on a notification in exceptional cases, and the Commission adopted a delegated act on this on 11 December 2025. TechTimes says critics think the core risk remains.
- Open source: Wikipedia records an April 2023 open letter from the Eclipse Foundation, the Open Source Initiative and The Document Foundation warning of a “chilling effect” on open-source development. The final text exempts open-source stewards from fines, though Wikipedia says concerns remained for small businesses redistributing open-source code.
- Wording and red tape: Wikipedia says Mozilla criticised unclear references to “commercial activity”, and CCIA Europe warned that red tape could hamper new technologies in Europe. These reactions were to earlier drafts.
- Readiness: TechTimes cites a 2026 Linux Foundation and OpenSSF report that surveyed 843 organisations and found 66% unfamiliar with the Act, up from 62% the year before.
- Platform teething problems: no API at launch means manual filing, per TechTimes.
- Source quality: we could not open the article text on EUR-Lex directly, so we read reproductions and cross-checked amounts with news reports. TechTimes is a news site, and cyberresilienceact.eu and several others are commentary.
The honest summary, in IoT Insights Hub’s view, is that the Act asks for normal good practice and puts a legal deadline on it. The hard parts are the 24-hour clock and the paperwork, not the engineering.
Cyber Resilience Act FAQs
What is the Cyber Resilience Act in simple words?
It is an EU law, Regulation 2024/2847, that sets cybersecurity rules for products with digital elements sold in the EU, such as smart watches and baby monitors. Makers must build security in, fix vulnerabilities for years and report actively exploited flaws, or face fines. Reporting started on 11 September 2026.
When did Cyber Resilience Act reporting start?
Reporting obligations began on 11 September 2026, according to the European Commission. The Act itself entered into force on 10 December 2024, and the main obligations, including CE marking and secure-by-design duties, apply from 11 December 2027. So reporting comes first, and the wider compliance work follows about 15 months later.
Does the Cyber Resilience Act apply to IoT devices made outside the EU?
Yes, if the device is sold in the EU. The Commission says the Act covers hardware and software products with digital elements, and TechTimes reports that non-EU manufacturers must appoint an authorised EU representative. Article 64 also lists authorised representatives among the roles that can be fined, so the obligation is real.
What are the fines under the Cyber Resilience Act?
Under Article 64, the top tier is up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential requirements or Articles 13 and 14. Lower tiers reach EUR 10 million or 2%, and EUR 5 million or 1%. Micro and small firms are exempt only for missing the 24-hour deadline.
How long must IoT makers support devices under the CRA?
At least five years, unless the product’s expected use time is shorter, according to recital 60 of the regulation and Article 13. Security updates must then stay available for at least 10 years after they are issued, or for the rest of the support period, whichever is longer, per the Article 13 text on Springlex.
What must be reported under the CRA and how fast?
Makers must report actively exploited vulnerabilities and severe incidents. The early warning is due within 24 hours of awareness and the notification within 72 hours. The final report follows within 14 days of a fix for vulnerabilities, or within one month for incidents. Reports go through ENISA’s Single Reporting Platform to the national CSIRT.
Sources behind this Cyber Resilience Act IoT guide from IoT Insights Hub
- European Commission, “Cyber Resilience Act” policy page (entry into force, dates, scope, CE marking, third-party assessment; page updated 7 September 2026)
- European Commission, “Cyber Resilience Act: Reporting obligations” (Article 14 timings, Single Reporting Platform, CSIRT routing, delegated act of 11 December 2025)
- European Commission, “Commission publishes new guidance to support timely Cyber Resilience Act implementation,” 27 July 2026 (non-binding guidance, 67 examples)
- Regulation (EU) 2024/2847, Official Journal, 20 November 2024 (recital text on EUR-Lex; Articles 13 and 64 read via Springlex’s reproduction)
- cyberresilienceact.eu (independent commentary and reproduced text: reporting contents, retention periods, launch platform details; not legal advice)
- TechTimes, “EU Cyber Resilience Act Goes Live,” 11 September 2026 (news report: penalties, platform status, critics, OpenSSF survey)
- Wikipedia, “Cyber Resilience Act” (history, scope, criticism; parts flagged as needing updates)
Is your team ready for the Cyber Resilience Act?
If you sell connected products in the EU, assume yes, it applies to you. Reporting duties are live, and the main obligations land on 11 December 2027. Start with the 24-hour clock, then build the support, documentation and conformity work around it. If you remember Cyber Resilience Act IoT in one line: build it secure, keep it patched for years, and tell the authorities fast when something is being exploited.
IoT Insights Hub will keep tracking how the Act plays out for device makers. For the business side of building in this space, read The Business Perspective’s report on AI agent startup funding in September 2026, and see IoT Mail Bridge on edge-to-cloud data security for IoT fleets.