Products with digital elements

Cyber Resilience Act: cybersecurity requirements for products with digital elements

Essential requirements, vulnerability handling, reporting from 11 September 2026 and technical documentation for CE marking.

Let's talkStarting assessment

The Cyber Resilience Act sets cybersecurity requirements for products with digital elements placed on the EU market, both hardware and software. Manufacturers must design them securely, handle vulnerabilities throughout the support period and report actively exploited vulnerabilities and severe incidents.

Who it applies to

  • Manufacturers of hardware and software products with digital elements sold in the Union.
  • Importers and distributors of those products.
  • Specific rules for important and critical products, and for open-source software in a commercial context.

What it requires

  1. 01

    Essential requirements

    Security by design, secure default configuration, data protection and a reduced attack surface.

  2. 02

    Vulnerability handling

    Software bill of materials (SBOM), security updates and coordinated vulnerability disclosure.

  3. 03

    Support period

    Security support for the expected period of use of the product.

  4. 04

    Reporting

    Notification of actively exploited vulnerabilities and severe incidents through the single reporting platform.

  5. 05

    Conformity assessment

    Technical documentation, EU declaration of conformity and CE marking.

Timeline

  1. 10 Dec 2024Entry into force.
  2. 11 Sep 2026Reporting obligations for exploited vulnerabilities and severe incidents.
  3. 11 Dec 2027All obligations apply.

EVIDEVO

How EVIDEVO manages controls and evidence for Cyber Resilience Act

Requirements by product

Each product has its own essential requirements, owners and support period.

Vulnerabilities and reports

Reporting deadlines and corrective actions tracked with date and author.

Technical documentation by version

SBOM, risk assessments and updates are linked to the product version.

Linked to NIS2 and ISO/IEC 27001

Evidence from the organisation's security processes, such as vulnerability handling, is also linked to product requirements.

Data for illustrative purposes only, not real

What can be exported

  • Technical documentation by product and version
  • Log of vulnerabilities and reports
  • Evidence of essential requirements

Capabilities for Cyber Resilience Act

How to determine whether Cyber Resilience Act applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk