Businesses across the EU have been given new European Commission guidance on how to apply the Cyber Resilience Act, a law that sets mandatory cybersecurity requirements for digital products.
The guidance is intended for manufacturers, software developers and other companies of all sizes, and is designed to help them prepare for required security measures and reporting duties, the European Commission noted in a release on Monday.
It said the document explains how the rules work in practice, including which products fall under the Act, what counts as a “substantial modification”, how support periods should be understood, and how to meet reporting and risk assessment requirements.
The Commission added that the guidance responds to questions raised by businesses, with particular attention to microenterprises and small and medium-sized enterprises, and includes examples and use cases.
Deadlines under the Act
The Cyber Resilience Act has been in force since December 2024 and covers cybersecurity across the full lifecycle of digital products, the Commission said.
Reporting obligations under the law will apply from 11 September 2026, with a broader compliance deadline set for December 2027.
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said the guidance forms part of the Commission’s “simplification agenda” and is intended to help businesses meet their obligations “on time and with confidence”.
The Commission stated that recent developments in frontier AI models with cybersecurity capabilities make swift and correct implementation of the Cyber Resilience Act more imperative.
