Cyber Resilience Act
New requirements for those who make digital products
The Cyber Resilience Act sets requirements for those who manufacture products with digital elements. Manufacturers take on greater responsibility for security.
What the regulation is
An EU regulation for products with software
The Cyber Resilience Act is Regulation (EU) 2024/2847. It sets requirements for products with digital elements that are sold in the EU. This covers both hardware and software. The regulation entered into force on 10 December 2024.
The requirements apply in three stages:
- 11 June 2026: The rules for the bodies that check the products started to apply.
- 11 September 2026: Since this date, manufacturers have had to report actively exploited vulnerabilities and severe incidents.
- 11 December 2027: The rest of the regulation starts to apply.
Always check what applies today before you plan around these dates.
For you as a buyer
Three changes for you as a buyer of equipment
Security becomes a requirement
From 11 December 2027, products must be secure by design before they can be sold. So security becomes a requirement before you even buy.
Vulnerabilities must be fixed
The manufacturer must fix vulnerabilities throughout the support period. That is the time during which the manufacturer promises to support the product. The length of the period must be stated.
The manufacturer must report
The manufacturer must report actively exploited vulnerabilities and severe incidents to the authorities. The manufacturer must also inform the users who are affected.
The reporting obligation also applies to products already on the market. Most other requirements apply to products placed on the market from 11 December 2027.
Existing equipment
Equipment you already have needs other protection
A control computer installed ten years ago does not become more secure because new products must be secure. It still runs the same software and has the same vulnerabilities.
Hide and Protect is designed for exactly that kind of equipment. The Lock stops all traffic to the equipment from anyone without an authorisation. Describe the protection as a compensating control. It reduces the risk without removing the vulnerabilities.
For machine builders
Do you build machines with control systems?
A machine with a network connection is often covered by the regulation. Then you, as the manufacturer, must meet the requirements. XoT can help you with some of them, such as protection from unauthorised access, encryption and logging. The customer does not need to open any inbound ports either.
Our responsibility
How we meet the regulation ourselves
We manufacture products with digital elements. So the regulation applies to us too.
Free security updates
The support period is five years for all our products. During that time, security updates are free of charge.
Reporting since September 2026
We report actively exploited vulnerabilities and severe incidents to ENISA within 24 hours.
Class I
Our assessment is that XoT-Lock and XMS are Class I important products.
Report vulnerabilities
Send them to security@xertified.com. Within five working days we confirm that we have received the report.
Documents on request
A software bill of materials (SBOM) and penetration-test reports. Test reports are shared under an NDA.
Requirements that apply to XertifiedUpdates and supportSecurity when AI finds the vulnerabilities
Common questions
Does the regulation cover our existing equipment?
Partly. Since 11 September 2026, manufacturers have had to report exploited vulnerabilities in products already on the market too. Most other requirements apply to new products. Your older equipment therefore needs other measures.
How do we know whether a manufacturer meets the requirements?
Ask how long the support period is and how the manufacturer handles vulnerabilities. The answers show how the manufacturer works with security. Our support period is five years.
What happens if a manufacturer stops providing support?
Then you have the same problem as with older equipment today. You need to protect the equipment in another way.
Do you help with our assessment?
We describe what XoT does. Your company makes the legal assessment, ideally together with a lawyer.
What we write here is our interpretation of the regulation. It is not legal advice.
Are you planning a procurement?
We answer technical questions in requirement specifications.