Cyber Resilience Act
From fitness trackers to connected manufacturing facilities: The EU is tightening the rules for digital products. With the Cyber Resilience Act, cybersecurity is becoming an integral part of product quality. Here’s what that means for businesses, consumers, and society.
Whether it’s a smartwatch, a smart heating system or an industrial machine: more and more products are now connected to the internet. This not only expands the possibilities of digitalisation, but also increases the risks. Security vulnerabilities can be exploited to steal data, tamper with devices or cripple entire systems. The European Union is responding to this with the Cyber Resilience Act (CRA). The first new reporting obligations for manufacturers of digital products have been in force since 11 September 2026.
Until now, the focus of product safety has primarily been on functionality and material quality. With the Cyber Resilience Act, digital security is now taking centre stage. This affects almost all products with digital elements, including smart home applications, routers, apps, wearables and connected machines. In future, manufacturers will be required to systematically identify security vulnerabilities, report serious incidents and provide security updates.
The new regulations come at a time when cyber-attacks are regularly making the headlines. At the same time, connected devices and AI-powered applications are finding their way into more and more areas of our lives. This is fuelling a wider public debate about how secure digital products actually are and who bears responsibility when vulnerabilities are exploited. The Cyber Resilience Act is intended to ensure greater transparency and binding security standards in this regard.
For businesses, the new requirements will initially mean additional work. Cybersecurity must be taken into account right from the development stage and maintained throughout the entire product life cycle. Many organisations will need to establish new processes to achieve this. In the long term, however, both manufacturers and consumers will benefit. Secure products strengthen trust in digital technologies, reduce the risks posed by cyberattacks and help to make the digital transformation more reliable. With the full implementation of the Cyber Resilience Act at the end of 2027, cybersecurity will become a prerequisite for many connected products on the European market.
In short: the Cyber Resilience Act makes it clear that, in future, cyber security will no longer be an optional extra, but a key component of modern product quality.
