EU Commission Publishes Guidelines for the Cyber Resilience Act: Here's What Changes

The European Commission has published a guidelines document for the Cyber Resilience Act (CRA), the regulation that imposes security requirements on products with digital elements throughout their entire lifecycle. The text, born from a public consultation and the work of a group of experts, aims to reduce interpretative ambiguities before the deadline of September 11, 2026, when the obligations to report serious incidents and actively exploited vulnerabilities will come into force.

What the guidelines contain

The document is structured around four main interpretative nodes:

1. Scope of application: cloud, remote data processing, and open source

The guide clarifies the boundaries of the regulation, distinguishing cases where a cloud service or a SaaS component falls within the definition of "product with digital elements" from those where it remains out of scope. On the open source front, it is confirmed that free software falls within the scope of the CRA only if it is placed on the market in the course of a commercial activity, while FOSS projects developed without commercial purposes remain excluded.

2. Substantial modification

Criteria and flowcharts are provided to distinguish an update that alters the security features of a product from a patch that falls within the normal management of the lifecycle. This clarification is crucial for IoT device manufacturers and software vendors that release frequent releases.

3. Support periods and reporting obligations

The guide helps calibrate the duration of support based on the expected lifecycle of the product. Furthermore, it illustrates how to structure vulnerability management and incident reporting processes towards ENISA and national CSIRTs, with already known timelines: 24 hours for the initial notification, 72 hours for the interim report, and 14 days for the final report from the availability of a corrective measure.

4. Focus on SMEs

The document includes 67 practical examples, use cases, flow diagrams, and charts designed to make the compliance path proportional to the size of the company, without unnecessarily burdening administrative costs.

Deadlines and coordination with NIS2

The two key dates are:

• September 11, 2026: activation of the obligations to report serious incidents and actively exploited vulnerabilities.
• December 11, 2027: final deadline for full technical and organizational compliance and for the affixing of the CE marking on products with digital elements placed on the European market.

The guidelines offer useful indications for integrating the documentary flows between the CRA and the NIS2, avoiding duplications and inconsistencies between the two documentary bases.

What CISOs and compliance officers should do today

Despite the non-binding nature of the document, the Commission's guide offers a yardstick that supervisory authorities and notified bodies will hardly ignore during verification. Here are the operational priorities:

• Map the real perimeter: verify, product by product, whether it falls within the scope of the CRA, with particular attention to cloud components, SaaS modules, and open source libraries integrated into commercial solutions.
• Formalize reporting processes: establish clear procedures for reporting incidents and vulnerabilities.
• Define support policies: set clear policies on support periods and end-of-life management.
• Train staff: ensure that your team is aware of the new requirements and knows how to implement them.

The guidelines contain practical examples that can help you get started.

Implications for consumers

The CRA will have a significant impact on consumers as well. According to the European Commission, by 2028, 70% of IoT devices sold in Europe will have to meet higher security standards. This could translate into:

• Safer products and less vulnerable to cyberattacks
• Greater transparency on security features
• Possible price increases for more complex devices

For consumers, the regulation represents an opportunity to purchase safer devices, but also a challenge in understanding the new technical information required on the label.

Future perspectives

The CRA is just the first step towards a more secure digital economy. The European Commission has already announced its intention to extend security obligations to new sectors, such as connected vehicles and medical devices. Furthermore, the Digital Omnibus of 2025 could introduce further changes to simplify compliance.

For companies, the priority now is to implement compliance processes before the September 2026 deadline. The guidelines published represent a valuable tool, but require a proactive approach and careful planning. Cybersecurity is no longer an option, but an essential requirement for operating in the European market.

Frequently Asked Questions

1. What is the difference between a substantial modification and a normal update?

A substantial modification is a change that alters the security features of a product and requires a new conformity assessment. The guidelines provide flowcharts to help distinguish between the two types of updates.

2. How can I verify if an open source component is compliant with the CRA?

If the component is distributed without commercial purposes, it is not subject to the CRA. If, on the other hand, it is integrated into a commercial product, the responsibility for compliance lies with the integrator. The guidelines recommend accurately documenting the use of open source.

3. What are the penalties for non-compliance?

Penalties can amount to up to 15 million euros or 2.5% of global annual turnover. Supervisory authorities can also order the withdrawal from the market of non-compliant products.

4. How can I prepare for the September 2026 deadline?

Start with a complete mapping of products subject to the CRA, formalize reporting processes, and define clear policies on support periods. The guidelines contain practical examples that can help you get started.

The Cyber Resilience Act represents a turning point for digital security in Europe. Despite the open issues, the guidelines published by the Commission offer a clear reference framework for companies. Compliance is no longer an option, but an essential requirement for operating in the European market. Companies that act now will not only be able to avoid penalties but also seize new market opportunities.