Cyber Resilience Act IoT: 7 Must-Know Duties for Makers
Key Takeaways The Cyber Resilience Act IoT reporting rules began on 11 September 2026. Per the European Commission, makers must now report actively exploited vulnerabilities and severe incidents. The clock is short: an early warning within 24 hours, a notification within 72 hours, then a final report. Reports go through ENISA’s Single Reporting Platform. The main obligations, including CE marking and secure-by-design duties, apply from 11 December 2027. The Act entered into force on 10 December 2024. The top fine tier is up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Article 64). Micro and small firms get a carve-out for the 24-hour deadline only. Support devices for at least five years, or the expected use time if shorter. Critics worry about pre-patch disclosure and open-source burdens, and a 2026 survey found 66% of 843 organisations unfamiliar with the Act. IoTOctober 23, 202613 min readBy IoT Insights Hub Editorial Team Cyber Resilience Act IoT: 7 Must-Know Duties for Makers Cyber Resilience Act IoT rules stopped being a future problem on 11 September 2026. From that day, anyone selling a connected product in the EU has had to report actively exploited vulnerabilities and severe incidents, and the first deadline is 24 hours. This guide from IoT Insights Hub sets out what the Act covers, the dates that matter, seven duties for makers, the reporting clock, the fines and the criticism. We read the Commission’s pages and the regulation text, and we say where a source is commentary or a news report. Not legal advice, just a plain-English map. Already building secure devices? Our guide to IoT security risks and how to fix them covers the technical side. In this guide What does the Cyber Resilience Act IoT rule set cover? When do the Cyber Resilience Act IoT deadlines apply? What are the 7 Cyber Resilience Act IoT duties for makers? How does the CRA reporting clock work? What are the penalties under the Cyber Resilience Act? What should IoT makers do this quarter? What do critics say about the Cyber Resilience Act? Cyber Resilience Act FAQs Is your team ready for the Cyber Resilience Act? 24 hoursdeadline for the early warning on an exploited vulnerability (European Commission) 5 yearsminimum support period unless expected use is shorter (Regulation 2024/2847) EUR 15Mtop fine tier, or 2.5% of worldwide turnover if higher (Article 64) 11 Dec 2027date the main obligations apply (European Commission) What does the Cyber Resilience Act IoT rule set cover? The Cyber Resilience Act, Regulation (EU) 2024/2847, sets mandatory cybersecurity rules for “software or hardware products with digital elements” sold in the EU. That covers connected devices such as baby monitors and smart watches, plus apps and programs. Manufacturers must build, maintain and report on security across the product’s life. The European Commission says the duties apply at every stage of the value chain and that national market surveillance authorities enforce them. Compliant products carry the CE marking, and some products of particular cybersecurity relevance need a third-party assessment by a notified body before sale. Who is in scope? Any connectable product sold in the EU, including from makers based elsewhere. TechTimes reports that non-EU manufacturers are covered and must name an authorised EU representative, which fits Article 64, since it lists authorised representatives among the roles that can be fined. The same report says reporting also reaches products already on the market, a point a commentary site, cyberresilienceact.eu, ties to Article 69(3). The Commission published non-binding guidance on 27 July 2026, with 67 practical examples, flowcharts and graphs. It explains when remote data processing and free and open source software fall in scope, what counts as a “substantial modification” and how support periods work. It pays particular attention to microenterprises and SMEs. For a wider picture of what these devices do, see our beginner guide to IoT. For the wired industrial side, where exposed controllers raise similar worries, read what is Modbus. When do the Cyber Resilience Act IoT deadlines apply? The Act entered into force on 10 December 2024. Reporting obligations began on 11 September 2026, and the main obligations, including secure-by-design duties, CE marking and conformity assessment, apply from 11 December 2027. The Commission published practical guidance on 27 July 2026 to help manufacturers prepare. Date What happened or applies Source 10 Dec 2024 Act entered into force European Commission 11 Dec 2025 Delegated act adopted on when a CSIRT may delay passing on notifications European Commission 27 Jul 2026 Non-binding practical guidance published European Commission 11 Sep 2026 Reporting obligations began European Commission 11 Dec 2026 Member States should strive to have enough notified bodies by this date (Article 35) Regulation text, via cyberresilienceact.eu 11 Dec 2027 Main obligations apply European Commission One small trap. Wikipedia lists the entry into force as 12 November 2024, while the Commission and EUR-Lex metadata say 10 December 2024. We use the Commission date, and Wikipedia itself flags parts of that page as needing updates. The gap between 2026 and 2027 is where many teams will slip. Reporting is live now, but the design, documentation and conformity work has a year left. In IoT Insights Hub’s view, treating the first date as a dress rehearsal for the second is the safest reading. The Cyber Resilience Act at a glance: key dates, products covered, maker duties and enforcement. What are the 7 Cyber Resilience Act IoT duties for makers? The Act does not number its duties, so this list is IoT Insights Hub’s grouping of Articles 13 and 14: design security in, vet third-party components, handle vulnerabilities, support devices for five years, report exploited flaws, keep documentation including an SBOM, and complete CE marking and conformity steps. Each duty below comes from the regulation text as reproduced by Springlex and cyberresilienceact.eu, checked against the Commission’s pages. Paragraph numbers differ between those two reproductions, so confirm exact wording on EUR-Lex before citing it. Design security in from the start. Article 13 says products must be designed, developed…