Cyber Resilience Act: manufacturer obligations and the workload for legal and compliance

Short answer: Cyber Resilience Act compliance (Regulation (EU) 2024/2847) requires manufacturers of products with digital elements to secure them across their life cycle: risk assessment, technical documentation, conformity assessment with CE marking and vulnerability handling for a support period of normally at least five years. Article 14 reporting has applied since 11 September 2026; everything else applies from 11 December 2027.

This guide is for heads of legal, heads of compliance and product owners at manufacturers, importers and distributors of hardware and software in Switzerland and Germany. It sets out who is in scope, which deadlines run and how much legal and compliance capacity to plan for.

What is the Cyber Resilience Act about?

The Cyber Resilience Act (CRA) sets horizontal cybersecurity requirements for almost every connectable product sold in the EU single market. It covers products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Art. 2(1)). A product with digital elements is any software or hardware product and its remote data processing solutions, including components placed on the market separately (Art. 3(1)).

The regulation was adopted on 23 October 2024, published in the Official Journal on 20 November 2024 and entered into force on 10 December 2024. It applies directly in every Member State; the core obligations need no national transposition. For legal and compliance teams it creates three workstreams:

• Product obligations: essential cybersecurity requirements in Annex I, cybersecurity risk assessment, technical documentation, EU declaration of conformity and CE marking (Art. 13).
• Life cycle: handling vulnerabilities throughout the support period, providing security updates and running a coordinated vulnerability disclosure policy (Art. 13(8)).
• Reporting: notifying actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and ENISA (Art. 14).

Who is affected?

Every economic operator that makes products with digital elements available on the EU market is affected, wherever it is based. Manufacturers carry most of the burden; importers and distributors have their own checking duties.

Exemptions include medical devices and in vitro diagnostics, vehicles under the type-approval regulation, certified aviation products and marine equipment (Art. 2(2)–(4)), and products developed exclusively for national security or defence (Art. 2(7)).

Switzerland: the CRA is EU law. Swiss companies are caught as soon as they make products available on the EU market. If they supply without an EU establishment, an EU importer must check conformity (Art. 19). Manufacturer obligations stay with the manufacturer; an authorised representative cannot take them over (Art. 18(2)).

Deadlines and current status

The CRA applies in stages. Reporting obligations already apply; the full product obligations follow at the end of 2027.

The Article 14 timelines are tight: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report no later than 14 days after a fix is available (vulnerabilities) or within one month of the notification (incidents). Reports go simultaneously to the CSIRT designated as coordinator and to ENISA through the single reporting platform (Art. 14(1) and (3), Art. 16).

Breaches of Annex I or Articles 13 and 14 can lead to fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)).

What companies need to do now

Start by establishing which products are in scope and in which role you act. Reporting, supply chain and documentation follow.

1. Build a product inventory: list all connected hardware and software, check the Article 2 exemptions and flag important products (Annex III) and critical products (Annex IV) (Art. 7, 8).
2. Define the role per product: manufacturer, importer or distributor; review own-brand products and substantial modifications separately (Art. 21).
3. Run the reporting process: set responsibilities, escalation and templates for the 24-hour, 72-hour and final reports, aligned with existing NIS2 and data breach procedures.
4. Secure the supply chain: document due diligence on third-party components, including open source (Art. 13(5)), and add vulnerability information and update duties to supplier contracts.
5. Set the support period: justify it per product in the technical documentation; security updates must stay available for at least ten years or the rest of the support period (Art. 13(8)–(9)).
6. Prepare documentation and conformity: risk assessment, technical documentation, conformity assessment, EU declaration of conformity and CE marking by December 2027; keep records for at least ten years (Art. 13(12)–(13)).
7. Align customer contracts and product information: make update, support and vulnerability commitments consistent with the support period you have set.

Which roles and capacity you need

A CRA programme cuts across the business: product and security teams own the technology, while legal and compliance own interpretation, contracts and evidence.

For legal and compliance, the workload concentrates in three blocks: the initial inventory, amending a large number of supplier contracts, and documentation per product. This work comes once and in waves. The ongoing base load – reports, new products, contract reviews – is usually handled by the existing team.

How interim support helps

Interim professionals cover the project peak without creating permanent headcount. Alpinum Solutions, the leading provider of interim legal & compliance in the DACH region, provides project lawyers, contract lawyers and compliance professionals through staff leasing and freelancing – part-time or full-time (20–100%), as individuals or teams, from junior to senior.

• Staff leasing: the client holds the right to issue professional instructions; the professional works as part of the team, for example on contract remediation.
• Freelancing: the professional works independently within the agreed mandate, for example on the role analysis of a product portfolio.

Selected profiles are usually available within 48 hours; the client and Alpinum agree the start date together.

Limits and risks

Responsibility for conformity and reporting stays with the manufacturer. Interim professionals work to the company's instructions and replace neither technical security testing nor a notified body. Delegated acts and standards under the CRA may still change details, so check project plans regularly against the current position.

Frequently asked questions on Cyber Resilience Act compliance

Does the Cyber Resilience Act apply to pure software?

Yes. A product with digital elements is any software or hardware product including its remote data processing, and components sold separately (Art. 3(1)). The product must have a direct or indirect data connection to a device or network (Art. 2(1)). Software in certain regulated sectors, such as medical devices, falls under the exemptions in Article 2.

Do products already on the market have to be upgraded?

In principle, no. Products placed on the market before 11 December 2027 are only subject to the requirements if they are substantially modified after that date (Art. 69(2)). The Article 14 reporting obligations, however, apply to all products in scope, including older ones (Art. 69(3)).

What must manufacturers report since 11 September 2026?

Every actively exploited vulnerability and every severe incident affecting the security of the product. Timelines: an early warning within 24 hours, a notification within 72 hours, then a final report. Reports go simultaneously to the coordinating CSIRT and ENISA via the single reporting platform (Art. 14, Art. 16).

Does the Cyber Resilience Act affect Swiss manufacturers?

Yes, as soon as they make products available on the EU market. The regulation is triggered by making products available on the Union market, not by where the company is based. An EU importer must check that the manufacturer meets the requirements (Art. 19). Products sold only in Switzerland are not directly covered.

How do the Cyber Resilience Act and NIS2 relate?

NIS2 governs the cybersecurity of entities and their operations; the CRA governs the security of products. A company can be subject to both, for example as a manufacturer and as an operator of important services. Plan the reporting processes together, with clear ownership for each reporting channel.

Next step

Tell us about the product portfolio, contract volume and timeline of your CRA programme. We will show you suitable legal and compliance profiles.

• Project lawyers for data privacy and IT law
• Regulatory radar: deadlines and obligations at a glance
• NIS2 and cyber incident reporting in Switzerland
• Data protection for product launches
• Discuss your requirements

Last updated: 10 November 2026.