EU Cyber Resilience Act: obligations for your software

Cyber Resilience Act: find out whether your software or app is covered, who must report a vulnerability and what to include in the contract.

Do you sell software, publish a mobile app or have a digital product developed by a service provider? Your company may be a “manufacturer” under the EU cybersecurity regulation for digital products, Regulation (EU) 2024/2847, known as the Cyber Resilience Act (CRA). Since September 11, 2026, manufacturers must report exploited vulnerabilities in their products and severe incidents within a few hours; most of the rest, including the security requirements, will apply from December 11, 2027.

Cyber Resilience Act: what has applied since September 11, 2026

Two events must be reported (Article 14): an “actively exploited” vulnerability, for which there is reliable evidence that a malicious actor has used it without authorization, and a severe incident affecting the security of the product. The European Commission’s page on reporting describes three steps:

an early warning, no later than 24 hours after becoming aware of the event;
a notification within 72 hours, describing the exploitation or the incident, the measures taken and those that users can apply;
a final report, no later than 14 days after a fix has been made available for a vulnerability, or one month after the notification for a severe incident.

These reports are submitted on the ENISA single reporting platform, run by the EU cybersecurity agency. They reach ENISA and, at the same time, the coordinating incident response center of the country where the manufacturer has its main establishment (in France, the CERT-FR of ANSSI, the French national cybersecurity agency). The manufacturer must also inform the affected users and, if necessary, tell them what measures to take.

The obligation also applies to products already on the market, but, according to ENISA’s FAQ, an exploitation the manufacturer knew about before September 11, 2026 does not have to be reported retroactively.

Is your software or app affected?

The regulation covers any software or hardware, together with its remote data processing, intended to connect to a device or a network and supplied in the course of a commercial activity, whether paid or free. The Commission’s guidance of July 27, 2026, which is not binding, provides some reference points:

a mobile app downloaded from an app store, or software installed on the user’s computer, is a product;
the server without which the app cannot perform one of its functions is part of the product, if it was designed by or for the manufacturer;
a web application used only in a browser, or a website that presents information, is not a product, unless it is used to operate a covered product; other texts, such as the GDPR, may apply to it.

A product made for one’s own use is not “placed on the market”, the Commission’s FAQ specifies, and certain products, such as medical devices and motor vehicles, are excluded.

Who is the manufacturer when you have a product developed?

The manufacturer is whoever develops a product, or has it designed and developed, and markets it under its own name or trademark. Using a service provider therefore does not transfer responsibility: for an app developed by a studio and published under your brand, it is in principle your company that bears the manufacturer’s obligations, including reporting.

Conversely, a service provider that sells its own solution under its own name, or grants a license to its source code, is the manufacturer of that solution. Anyone who substantially modifies an existing product and then makes it available becomes the manufacturer of the modified part, or even of the whole product if the modification affects the cybersecurity of the product as a whole (Article 22).

A custom tool for internal use is assessed case by case. For a custom product intended for a specific business customer, two exemptions are possible if both parties explicitly provide for them in the contract: on secure-by-default configuration and on free security updates.

What will be required from December 11, 2027

Products placed on the market from December 11, 2027 will have to meet the essential security requirements (Annex I). In particular, the manufacturer will have to:

draw up the list of software components, in a commonly used machine-readable format, covering at least those the product uses directly, with no obligation to publish it;
fix vulnerabilities without delay, where possible through security updates separate from feature updates, free of charge unless otherwise agreed for a custom product;
regularly test the product’s security, apply a coordinated vulnerability disclosure policy (handling the vulnerabilities that third parties report) and provide an address for reporting them;
carefully check components supplied by others, including open source software.

The manufacturer will set a support period (during which it handles vulnerabilities) of at least five years, or equal to the expected period of use if that is shorter, and will state its end date at the time of purchase. Each security update will remain available for at least ten years, or until the end of the support period if that is longer. Products placed on the market before December 11, 2027 are only subject to these requirements if they are substantially modified after that date.

What to include in the contract with your service provider

The 24-hour deadline starts as soon as the manufacturer becomes aware of the exploitation: if your service provider hosts and monitors the app, the contract must specify how the provider alerts you. Points to put in writing:

who the manufacturer is and who will draw up the technical documentation and the declaration of conformity required from December 2027;
a short deadline for alerting you in the event of a suspected exploitation or incident, and the people registered on the ENISA platform;
the list of components for each version, monitoring of external components and fix deadlines based on severity;
the support period, security updates and any exemptions (custom product);
access to the source code, to the tools used to build the software and to the documentation: the manufacturer remains responsible throughout the support period, even if it changes service providers.

To pass on to your service provider: this list is the software bill of materials (SBOM), with top-level dependencies at a minimum.

A concrete example

Take, as an illustration, a 30-person SME that distributes professional equipment. It has had a mobile app for ordering and delivery tracking developed under its brand, with a server designed for it and hosted by the service provider. The SME is in principle the manufacturer, and this server is part of the product.

One Friday evening, the service provider’s monitoring detects abnormal access to the server, exploiting a vulnerability in an external component. If the contract provides for an alert within a few hours and an SME representative is already registered on the platform, the early warning can go out within 24 hours; otherwise, the deadline becomes hard to meet.

Frequently asked questions

Is a small business exempt from reporting vulnerabilities?

No. Microenterprises and small enterprises are only exempt from the fine for missing the 24-hour early warning deadline. For other breaches of Articles 13 and 14 (manufacturer obligations, reporting) or of Annex I, the fine is capped at €15 million or 2.5% of worldwide annual turnover, whichever is higher; each Member State sets its own penalties.

Does a vulnerability found during an audit have to be reported?

No, as long as no malicious exploitation has been established: according to the Commission’s FAQ, a vulnerability found during tests carried out for the manufacturer does not have to be reported. Fix it quickly; you can also report it voluntarily (Article 15).

Where should I start now?

List the products published under your brand and their manufacturer. Register a main representative and at least one secondary representative on the ENISA platform, each with a European Commission EU Login account protected by multi-factor authentication (in addition to the password). Finally, review your contracts.

411bit can help: security audit of your applications and their components (Secure), custom development with no proprietary lock-in, with the option of handing over the code, the documentation and the list of software components (Build), monitoring with alerts and ongoing maintenance under a contractual service level (Run). To review your situation, contact us: every request receives a reply within 24 business hours. If another provider developed your application, the project for the audit and then takeover of an industrial B2B platform illustrates the approach.