REGULATION (EU) 2024/2847

Chapter I sets out the subject matter, the scope and the definitions, and introduces three tiers of products. We picked what decides the question “does this apply to us”: the scope (Art. 2), the definitions (Art. 3), the basic rule for making a product available on the market (Art. 6), the product categories (Art. 7 and 8) and the overlap with the AI Act (Art. 12). We left out Art. 1 (subject matter), Art. 4 (free movement), Art. 5 (procurement and use), Art. 9 (stakeholder consultation), Art. 10 (skills) and Art. 11 (general product safety) — they are addressed to the Member States and the Commission and give a manufacturer nothing to act on.

The regulation applies to products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Products covered by sector-specific regimes are excluded — medical devices, in vitro diagnostics, motor vehicles, products certified in civil aviation and marine equipment. Also excluded are spare parts produced to the same specifications as the component they replace, and products developed exclusively for national security, defence or the processing of classified information. The Commission may, by delegated act, limit the application of the regulation where sector-specific rules deliver the same or a higher level of protection.

The article contains 51 definitions. Four of them decide most questions in practice. A manufacturer (point 13) is not only whoever develops or manufactures the product, but also whoever has it designed, developed or manufactured and markets it under its own name or trademark, whether for payment, monetisation or free of charge. An open-source software steward (point 14) is a legal person, other than a manufacturer, whose purpose is to provide systematic and sustained support for the development of specific open-source products intended for commercial activities and to ensure their viability. A substantial modification (point 30) is a change after the product has been placed on the market that affects compliance with the essential requirements in Part I of Annex I or changes the intended purpose; an actively exploited vulnerability (point 42) is one for which there is reliable evidence that a malicious actor has exploited it without permission of the system owner.

One sentence that carries the whole regulation. A product may be made available on the market only if it meets the essential cybersecurity requirements in Part I of Annex I — provided it is properly installed, maintained and used for its intended purpose or under reasonably foreseeable conditions — and if the processes put in place by the manufacturer meet the requirements in Part II of Annex I.

A product whose core functionality falls within one of the categories in Annex III counts as an important product and is subject to the stricter conformity assessment procedures under Art. 32(2) and (3). The regulation says explicitly that integrating such a product into another product does not, in itself, make that other product an important product.

For the categories in Annex IV, the Commission may determine by delegated act that a product must obtain a European cybersecurity certificate at assurance level at least “substantial” in order to demonstrate conformity — and only where an adopted European cybersecurity certification scheme is available to manufacturers for that category. The required assurance level has to be proportionate to the risk and must take into account the critical dependence of essential entities under NIS 2 on the product.

A product that falls under the CRA and is at the same time a high-risk AI system under Art. 6 of Regulation (EU) 2024/1689 is deemed to comply with the cybersecurity requirements of Art. 15 of the AI Act, provided it meets Part I of Annex I, its manufacturer meets Part II of Annex I, and the level of protection achieved is confirmed in the EU declaration of conformity issued under the CRA. Conformity assessment then normally runs under the AI Act procedure, and notified bodies competent for AI are also competent for the Annex I requirements of the CRA. For important and critical products, however, the CRA procedures apply to the cybersecurity requirements.

This is the core of the regulation for anyone who puts something on the market. We picked the obligations of manufacturers (Art. 13), the reporting obligations (Art. 14), the platform through which reports are made (Art. 16), authorised representatives (Art. 18), the obligations of importers (Art. 19) and distributors (Art. 20), both rules on manufacturer obligations passing to other parties (Art. 21 and 22) and the regime for open-source software stewards (Art. 24). We left out Art. 15 (voluntary reporting), Art. 17 (other provisions on reporting, addressed to ENISA and the CSIRTs network), Art. 23 (identification of economic operators at the request of a market surveillance authority), Art. 25 (voluntary security attestation of open-source software, which a delegated act still has to create) and Art. 26 (Commission guidance).

The longest article in the regulation, 25 paragraphs. The manufacturer must design, develop and produce the product in line with Part I of Annex I, carry out a cybersecurity risk assessment and feed its outcome into planning, design, development, production, delivery and maintenance. The assessment is documented, kept up to date for the support period and included in the technical documentation, together with a justification for any requirement that does not apply to the product. The article also imposes due diligence on third-party components including open source, reporting of vulnerabilities to whoever maintains the component, a support period of at least five years, availability of issued security updates for at least ten years, information duties on the product and under Annex II, a single point of contact for users, disclosure of the end of the support period at the time of purchase, and retention of documentation for at least ten years.

Introduces two separate reporting duties. An actively exploited vulnerability in the product, and a severe incident having an impact on the security of the product, are both reported by the manufacturer simultaneously to the CSIRT designated as coordinator and to ENISA through the single reporting platform. The same cascade applies to both: an early warning without undue delay and within 24 hours of becoming aware of the matter; a follow-up notification within 72 hours; and a final report within 14 days of a corrective or mitigating measure becoming available for a vulnerability, or within one month of the notification under point (b) for an incident. An incident is severe if it affects or can affect the ability of the product to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or if it has led or can lead to the introduction or execution of malicious code in the product or in the systems of a user. Which CSIRT is yours follows from your main establishment in the Union; without one, a cascade runs through the authorised representative, the importer, the distributor and the number of users. The manufacturer informs affected users, where appropriate in a structured, machine-readable format.

The platform for notifications under Art. 14 and 15 is established and operated by ENISA; the Member States and ENISA each have their own electronic notification end-points on it. The CSIRT that receives a notification first passes it on without delay to the coordinators in the Member States where, according to the information provided by the manufacturer, the product has been made available. In exceptional circumstances, and in particular at the request of the manufacturer, dissemination may be delayed on justified cybersecurity grounds for as long as is strictly necessary; in duly justified exceptional cases only limited information is shared with the others until the full notification can be disseminated. A delay is also possible where the vulnerability is subject to coordinated disclosure under NIS 2.

A manufacturer may appoint an authorised representative by written mandate. The core of the manufacturer obligations cannot be delegated: Art. 13(1) to (11), the first subparagraph of Art. 13(12) and Art. 13(14). The mandate must at least allow the representative to keep the EU declaration of conformity and the technical documentation for at least ten years or for the support period, to provide them to the market surveillance authority on a reasoned request, and to cooperate on eliminating risks.

An importer may place on the market only a product that meets Part I of Annex I and whose manufacturer processes comply with Part II. Before placing it on the market, the importer must verify that the manufacturer carried out the conformity assessment under Art. 32, drew up the technical documentation, affixed the CE marking, enclosed the declaration of conformity and the information and instructions under Annex II in a language that is easily understood, and complied with the identification and information duties under Art. 13(15), (16) and (19). Where there is doubt, the product is not placed on the market, and where there is a significant cybersecurity risk, the importer informs both the manufacturer and the market surveillance authority. On learning of a vulnerability, the importer informs the manufacturer without undue delay; a copy of the declaration of conformity is kept for at least ten years or for the support period.

A distributor acts with due care and, before making a product available on the market, verifies that it bears the CE marking and that the manufacturer and the importer have met their identification and information duties and handed over the required documents. If, on the basis of the information at its disposal, it has reason to believe that the product or the manufacturer processes are not in conformity, it must not make the product available; where there is a significant cybersecurity risk, it informs the manufacturer and the market surveillance authority. On becoming aware of a vulnerability, it informs the manufacturer without undue delay and cooperates with the market surveillance authority on its reasoned request.

A single sentence with a wide reach. An importer or distributor is considered a manufacturer, and Art. 13 and 14 apply to it, where it places a product on the market under its own name or trademark, or where it carries out a substantial modification of a product already on the market.

A person who is neither a manufacturer, an importer nor a distributor, but who carries out a substantial modification of a product and makes it available on the market, is considered a manufacturer. The obligations under Art. 13 and 14 apply to that person in respect of the part of the product affected by the modification; where the modification affects the cybersecurity of the product as a whole, they apply to the whole product.

An open-source software steward puts in place and verifiably documents a cybersecurity policy that fosters secure development and the effective handling of vulnerabilities by the developers of the product, supports voluntary reporting under Art. 15 and takes account of the specific nature of the steward. On a reasoned request it provides that documentation to the market surveillance authority and cooperates with it on mitigating risks. The reporting obligations under Art. 14(1) apply to the extent that the steward is involved in the development of products, and those under Art. 14(3) and (8) to the extent that severe incidents affect the network and information systems it provides for development.

The chapter describes the route from meeting the requirements to the CE marking. We picked the presumption of conformity and common specifications (Art. 27), the EU declaration of conformity (Art. 28), the rules for affixing the CE marking (Art. 30), the technical documentation (Art. 31), the conformity assessment procedures (Art. 32) and the support measures for smaller enterprises (Art. 33). We left out Art. 29, which only refers to the general principles of the CE marking in Regulation (EC) No 765/2008, and Art. 34 on mutual recognition agreements with third countries — neither has a direct effect on the obligations of a manufacturer in the Union.

Products and processes that are in conformity with harmonised standards, or parts of them, the references to which have been published in the Official Journal are presumed to be in conformity with those requirements of Annex I that the standards cover. The Commission requests the European standardisation organisations to draft the standards. Where the standards are not delivered or do not match the request, and no reference to them is expected in the Official Journal either, the Commission may lay down common specifications by implementing act, which create the presumption of conformity in the same way. A certificate or statement of conformity under a European cybersecurity certification scheme adopted under Regulation (EU) 2019/881 creates the presumption as well.

The manufacturer draws up the declaration, states in it that the applicable requirements of Annex I have been demonstrated to be fulfilled, and assumes responsibility for its content. It follows the model in Annex V, contains the elements from the conformity assessment procedure used as set out in Annex VIII, is kept up to date, and must be available in the languages required by the Member State where the product is placed or made available on the market. A simplified version following the model in Annex VI must state the exact internet address at which the full declaration can be found. Where a product is subject to more than one Union act requiring a declaration, a single declaration is drawn up.

The marking is affixed visibly, legibly and indelibly to the product; where that is not possible or not warranted, to the packaging and to the accompanying EU declaration of conformity. For products in the form of software it is affixed either to the EU declaration of conformity or to the website accompanying the product, where the relevant section must be easily and directly accessible to consumers. It is affixed before the product is placed on the market and is followed by the identification number of the notified body where one was involved in the assessment under module H.

The documentation must contain all the data on the means by which the manufacturer ensured that the product and its processes comply with Annex I, and at least the elements set out in Annex VII. It is drawn up before the product is placed on the market and kept up to date at least for the support period. For products under Art. 12 that are also covered by other Union acts with documentation requirements, a single set is drawn up. The documentation and the correspondence relating to conformity assessment are kept in a language of the Member State of the notified body or in a language accepted by that body.

For a default product the manufacturer chooses between internal control (module A), EU type-examination with a follow-up module C, conformity assessment based on full quality assurance (module H) and, where available, a European cybersecurity certification scheme. For an important class I product under Annex III, if the manufacturer has not applied harmonised standards, common specifications or certification at least at level “substantial”, has applied them only in part, or they do not exist, the route must run through modules B and C or through module H. For class II, third-party assessment is always mandatory. For critical products under Annex IV, the European cybersecurity certification scheme under Art. 8(1) applies, and where its conditions are not met, the class II regime. Fees are to take the needs of smaller enterprises into account.

Member States are to provide smaller enterprises with awareness raising and training, a dedicated channel for questions about implementing the regulation, and support for testing and conformity assessment. They may also establish regulatory sandboxes as a controlled testing environment before a product is placed on the market. Microenterprises and small enterprises may provide the elements of the technical documentation under Annex VII in a simplified form; the form is to be laid down by the Commission in an implementing act and notified bodies must accept it.

We picked four provisions with a direct effect on manufacturers: market surveillance (Art. 52), penalties (Art. 64), transitional provisions (Art. 69) and application (Art. 71). We left out the whole of Chapter IV on the notification of conformity assessment bodies (Art. 35 to 51) — it is addressed to the Member States and to the bodies themselves, and the only practical information a manufacturer takes from it is that it has applied since 11 June 2026 and that the capacity of the bodies is still being built. We also left out the procedural part of market surveillance (Art. 53 to 60), the delegated powers and the committee procedure (Art. 61 and 62), confidentiality (Art. 63), representative actions (Art. 65), the amendments to other acts (Art. 66 to 68) and the evaluation and review (Art. 70).

Regulation (EU) 2019/1020 on market surveillance applies to products within the scope of the regulation, and each Member State designates one or more market surveillance authorities. The same authorities also supervise the obligations of open-source software stewards under Art. 24. In supervising the reporting obligations they cooperate with the CSIRTs and with ENISA; for products that are at the same time high-risk AI systems, the authorities designated under the AI Act take over the role. A dedicated administrative cooperation group is established, which among other things publishes statistics on support periods by product category and issues guidance on them.

The levels are graduated by what is breached. Non-compliance with the essential requirements of Annex I and with the obligations under Art. 13 and 14 carries an administrative fine of up to EUR 15 000 000 or, for an undertaking, up to 2.5 % of total worldwide annual turnover for the preceding financial year, whichever is higher. Infringements of the obligations under Art. 18 to 23, Art. 28, Art. 30(1) to (4), Art. 31(1) to (4), Art. 32(1) to (3), Art. 33(5) and Art. 39, 41, 47, 49 and 53 have a ceiling of EUR 10 000 000 or 2 %. Supplying incorrect, incomplete or misleading information to notified bodies and market surveillance authorities carries EUR 5 000 000 or 1 %. The amount takes account of the nature, gravity and duration of the infringement, of fines imposed previously and of the size of the entity. Paragraph 10 then, by way of derogation from paragraphs 3 to 9, rules out fines for microenterprises and small enterprises for missing the early warning deadline under Art. 14(2), point (a), and Art. 14(4), point (a), and for open-source software stewards for any infringement of the regulation.

EU type-examination certificates and approval decisions issued for cybersecurity requirements under other Union harmonisation acts remain valid until 11 June 2028, unless they expire earlier or unless those acts provide otherwise. Products placed on the market before 11 December 2027 are subject to the regulation only if they undergo a substantial modification after that date. By way of derogation, however, the obligations under Art. 14 apply to all products within the scope of the regulation that were placed on the market before 11 December 2027.

The regulation entered into force on the twentieth day following its publication in the Official Journal. It applies from 11 December 2027, with two exceptions: Article 14 applies from 11 September 2026, and Chapter IV, that is Articles 35 to 51 on the notification of conformity assessment bodies, from 11 June 2026. The regulation is binding in its entirety and directly applicable in all Member States.

The annexes carry most of the substance of the regulation. Annex I contains the essential cybersecurity requirements in two parts, Annex II the information and instructions to the user, Annexes III and IV the categories of important and critical products, Annexes V and VI the models for the EU declaration of conformity and its simplified version, Annex VII the content of the technical documentation and Annex VIII the conformity assessment procedures based on modules A, B, C and H. We cover six of them; the declaration models in Annexes V and VI are left aside, because they are forms to be filled in, not rules to be interpreted.

Point 1 is general: the product must be designed, developed and produced so as to ensure an appropriate level of cybersecurity based on the risks. Point 2 then sets out thirteen specific properties, points (a) to (m), which apply where applicable on the basis of the risk assessment under Art. 13(2) — being made available without known exploitable vulnerabilities, a secure by default configuration with the possibility of resetting the product to its original state, the ability to address vulnerabilities through security updates, protection from unauthorised access, confidentiality and integrity of data, data minimisation, availability of essential and basic functions after an incident, minimising the adverse impact of the product itself, limiting attack surfaces, reducing the impact of an incident, recording and monitoring security-relevant activity, and the possibility to remove or transfer data securely and permanently.

Eight requirements on the processes of the manufacturer. Identify and document vulnerabilities and components contained in the product, including by drawing up a software bill of materials in a machine-readable format covering at least the top-level dependencies. Address and remediate vulnerabilities without delay and, where technically feasible, provide security updates separately from functionality updates. Apply regular tests and reviews of security. Once a fix has been released, publish information about the vulnerability, its impact and severity and about how to remediate it, with the option of delaying publication in duly justified cases. Put in place and enforce a coordinated vulnerability disclosure policy. Facilitate the sharing of information and provide a contact address for reporting. Have mechanisms for distributing updates securely, automatically where that is possible. Disseminate security updates without delay and free of charge, together with an advisory message.

It lists what has to accompany the product: the identity and contact details of the manufacturer, the single point of contact for reporting vulnerabilities and a reference to the coordinated vulnerability disclosure policy, an unambiguous identification of the product, the intended purpose including the security environment and the security functionalities, known or foreseeable circumstances that may lead to significant risks, where applicable the address at which the EU declaration of conformity can be found, the type of technical security support offered and the end date of the support period, and detailed instructions or a reference to them — on putting the product into service, on the effect of changes on the security of data, on installing updates and on secure decommissioning including the deletion of user data.

It contains two classes. Class I has nineteen categories — among them identity management and privileged access management software and hardware, browsers, password managers, software that searches for, removes or quarantines malicious software, products with a virtual private network function, network management systems, security information and event management systems, boot managers, public key infrastructure, network interfaces, operating systems, routers and switches, microprocessors, microcontrollers and ASIC and FPGA circuits with security-related functionalities, smart home virtual assistants and smart home products with security functionalities, internet connected toys with interactive or location-tracking features, and personal wearable products with a health monitoring purpose. Class II has four categories: hypervisors and container runtime systems, firewalls and intrusion detection and prevention systems, and tamper-resistant microprocessors and microcontrollers.

The shortest annex and the one with the heaviest consequences. It contains three items: hardware devices with security boxes; smart meter gateways within smart metering systems as defined in Directive (EU) 2019/944 and other devices for advanced security purposes; and smart cards or similar devices, including secure elements.

Eight points. A general description of the product including its intended purpose, the versions affecting compliance and, where applicable, photographs and the information and instructions under Annex II. A description of the design, development and production and of the vulnerability handling processes — this is where the architecture belongs, together with the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the contact address for reporting and a description of the secure distribution of updates. The cybersecurity risk assessment under Art. 13, including how the requirements of Part I of Annex I apply. The information the manufacturer relied on when determining the support period. A list of the harmonised standards and common specifications applied, or a description of the solutions adopted where they were not. Test reports. A copy of the EU declaration of conformity. And, on a reasoned request from a market surveillance authority, the software bill of materials.

It describes the modules referred to in Art. 32. Part I is internal control based on module A: the manufacturer draws up the technical documentation under Annex VII, ensures on its own responsibility that the product and its processes comply with Annex I, affixes the CE marking and draws up a written EU declaration of conformity, which it keeps together with the documentation for at least ten years or for the support period. The other parts describe EU type-examination based on module B, where a notified body examines the technical design, the development and the vulnerability handling processes, the follow-up conformity to type based on module C, and conformity assessment based on full quality assurance under module H.