EU Cyber Resilience Act: what connected product teams need to operationalize

TL;DR: Connected products now face cybersecurity obligations across design, release, monitoring and reporting, according to VicOne, and the EU Cyber Resilience Act tightens the timeline with reporting starting in September 2026 and main compliance from December 2027. Cyber resilience becomes an operational governance problem, not a documentation exercise.

Editorial analysis by NHI Mgmt Group, based on content published by VicOne: “When Cyber Risk Becomes Physical: What the EU Cyber Resilience Act Means for Connected Machines and Physical AI”.

By the numbers:

• Reporting obligations begin on September 11, 2026, under the EU Cyber Resilience Act.
• The main compliance requirements apply from December 11, 2027, under the EU Cyber Resilience Act.
• The CRA entered into force on December 10, 2024.

Key questions

Q: What breaks when manufacturers do not have product-level visibility for CRA compliance?

A: Without product-level visibility, manufacturers cannot reliably identify which builds contain a vulnerable component, which customers are affected, or whether an issue requires remediation, disclosure or both.

Q: Why does the EU Cyber Resilience Act create operational risk as well as compliance risk?

A: The CRA turns cybersecurity into an ongoing product responsibility, so failures affect release readiness, reporting obligations and customer trust, not just audit status.

Q: What are the signs that a product security programme is not ready for CRA compliance?

A: A programme is not ready when product scope is unclear, third-party components are not verified, and incident reporting paths are undefined.

Practitioner guidance

• Build a product-level component inventory Track components, firmware dependencies, supplier modules and deployed product versions so teams can identify exactly which builds are affected when a vulnerability is disclosed.
• Operationalize SBOM maintenance across the portfolio Keep SBOMs current for release builds and post-release updates, then tie them to affected-product analysis so disclosure decisions are based on accurate composition data.
• Prepare CRA reporting workflows before the 2026 deadline Connect threat detection, vulnerability triage, affected-product analysis and disclosure readiness so reporting does not depend on ad hoc manual coordination.

Bottom line: The CRA makes cybersecurity an ongoing product obligation, which means manufacturers need lifecycle governance instead of one-time compliance activity.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →