Cyber Resilience Act
New requirements for those who make digital products
The Cyber Resilience Act sets requirements for those who manufacture products with digital elements. Manufacturers take on greater responsibility for security.
What the regulation is
An EU regulation for products with software
The Cyber Resilience Act is Regulation (EU) 2024/2847. It sets requirements for products with digital elements that are sold in the EU. This covers both hardware and software. The regulation entered into force on 10 December 2024.
The requirements apply in three stages:
- 11 June 2026: The rules for the bodies that check the products started to apply.
- 11 September 2026: Since this date, manufacturers have had to report actively exploited vulnerabilities and severe incidents.
- 11 December 2027: The rest of the regulation starts to apply.
Always check what applies today before you plan around these dates.
For you as a buyer
Three changes for you as a buyer of equipment
Security becomes a requirement
From 11 December 2027, products must be secure by design before they can be sold. So security becomes a requirement before you even buy.
Vulnerabilities must be fixed
The manufacturer must fix vulnerabilities throughout the support period. That is the time during which the manufacturer promises to support the product. The length of the period must be stated.
The manufacturer must report
The manufacturer must report actively exploited vulnerabilities and severe incidents to the authorities. The manufacturer must also inform the users who are affected.
The reporting obligation also applies to products already on the market. Most other requirements apply to products placed on the market from 11 December 2027.
Existing equipment
Equipment you already have needs other protection
A control computer installed ten years ago does not become more secure because new products must be secure. It still runs the same software and has the same vulnerabilities.
Hide and Protect is designed for exactly that kind of equipment. The Lock stops all traffic to the equipment from anyone without an authorisation. Describe the protection as a compensating control. It reduces the risk without removing the vulnerabilities.
Our responsibility
What the regulation means for us
We manufacture products with digital elements. So the requirements apply to us too.
Proven encryption
The encryption comes from WireGuard. WireGuard has a small codebase of about 4,000 lines.
Tested against attacks
Several companies have tried to break into XoT in what are called penetration tests. The technology is built on proven reference standards and frameworks.
Report vulnerabilities
You can report vulnerabilities to security@xertified.com. Within five working days we confirm that we have received the report.
Common questions
Does the regulation cover our existing equipment?
Partly. Since 11 September 2026, manufacturers have had to report exploited vulnerabilities in products already on the market too. Most other requirements apply to new products. Your older equipment therefore needs other measures.
How do we know whether a manufacturer meets the requirements?
Ask how long the support period is and how the manufacturer handles vulnerabilities. The answers show how the manufacturer works with security.
What happens if a manufacturer stops providing support?
Then you have the same problem as with older equipment today. You need to protect the equipment in another way.
Do you help with our assessment?
We describe what XoT does. Your company makes the legal assessment, ideally together with a lawyer.
What we write here is our interpretation of the regulation. It is not legal advice.
Are you planning a procurement?
We answer technical questions in requirement specifications.