EU cyber resilience rules cover software and require incident reporting

The EU Cyber Resilience Act covers more than connected hardware. Downloadable applications, enterprise software, software agents and commercially supplied components can qualify as products with digital elements, depending on their functionality, intended use and connection to devices or networks. Supporting cloud functionality may also fall within scope when its absence would prevent a product from performing a function. Standalone SaaS is not automatically covered.

Reporting obligations have applied since September 11, 2026, requiring covered manufacturers to report actively exploited vulnerabilities and severe security incidents. An early warning is required within 24 hours, followed by subsequent reporting within 72 hours. Most substantive requirements take effect on December 11, 2027, including cybersecurity-by-design, vulnerability handling, technical documentation, conformity assessment and CE marking.

U.S. companies placing covered products on the EU market can have direct manufacturer obligations even without an EU establishment. Importers and distributors may have separate duties. Depending on the infringement, fines can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher. Authorities can also restrict market access for non-compliant products.

High-risk AI systems under the EU AI Act face special rules. In Germany, the Federal Network Agency oversees CRA compliance for those products in cooperation with the Federal Office for Information Security. Businesses should inventory EU-bound products, establish their regulatory roles and review reporting procedures while preparing for broader compliance requirements.