The EU Cyber Resilience Act, Regulation (EU) 2024/2847, applies in stages. Chapter IV applied from 11 June 2026, the Article 14 reporting obligations apply from 11 September 2026, and the regulation applies in general from 11 December 2027. This is a summary of dates and recitals, not legal advice, and whether your product is in scope needs checking.
The three dates
Article 71 sets them out:
- Chapter IV (Articles 35 to 51) applies from 11 June 2026.
- Article 14 applies from 11 September 2026.
- The regulation applies from 11 December 2027.
As of this review in October 2026, the first two dates have already passed. If you make products with digital elements for the EU market, the reporting article is already live, so your process for it should exist.
What the recitals say
The recitals explain intent. They are not the binding articles, but they show what regulators expect.
- Vulnerability handling obligations apply to products with digital elements in their entirety, including all integrated components (Recital 34).
- Manufacturers must comply with the vulnerability handling requirements throughout the support period (Recital 54).
- The support period should be no less than five years, unless the product's expected lifetime is shorter (Recital 60).
- New security updates should, where technically feasible, be provided separately from functionality updates (Recital 57).
- Recital 22 refers to software bills of materials that manufacturers generate under the regulation, which market surveillance authorities can request for certain product categories.
I could not confirm the exact wording of the Annex I requirements from the text I read, so check the article and annex text for specifics.
What it means for robots and connected devices
A robot controller, a drone ground station and a vehicle accessory all contain software, and many include open source components. The recitals make clear that integrated components count. A flaw in a third-party library is your problem to track and fix during the support period.
A readiness list
- Inventory every component in every shipped version, including transitive dependencies.
- Decide who receives vulnerability reports, how they are triaged, and who owns the clock.
- Build an update path that can ship security fixes without waiting for a feature release.
- Document your support period and make sure it is at least five years where the product is expected to last that long.
- Confirm with counsel whether your product category is in scope or covered by other rules.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM generation and dependency scanning cover step one for the software you build, and they are available to try through the free scan at https://gold.safeguard.sh/scan.
Quick check
Is the Article 14 date in the past?
Yes. Article 14 applies from 11 September 2026, which has passed as of this review.
When does the general application begin?
On 11 December 2027, according to Article 71.
Sources
Last reviewed: 19 October 2026.
