Regulation (EU) 2024/2847 – better known as the Cyber Resilience Act (CRA) – is now part of the legal framework of the European Union. The Regulation enters into force on 10 December 2024, with the majority of its provisions becoming applicable as of 11 December 2027. Certain obligations related to vulnerability notification and reporting will apply as early as 2026. The focus is no longer on what the Regulation provides, but on whether organisations are prepared to implement it.
 
2026–2027: A Period of Active Preparation
Although full application will begin in December 2027, organisations that develop or place on the market products with digital elements should use 2026 as a period to structure their internal processes.
In practical terms, this means:

• conducting an internal gap analysis against the requirements of the CRA
• identifying all products and digital components within the portfolio
• reviewing architectural decisions and dependencies on third-party suppliers
• formalising processes for vulnerability management and security updates.

The CRA does not introduce a one-time compliance obligation; rather, it requires continuous processes throughout the entire product lifecycle.
 
From a Technical Matter to Management Responsibility
The Regulation EU 2024/2847 transforms cybersecurity from an operational IT function into a regulatory obligation with a clear management dimension.
Decisions regarding the software components used, open-source libraries, support periods, and mechanisms for updates and incident response now carry direct legal significance.
This requires a clear allocation of internal responsibilities and active involvement of management bodies. The absence of a structured decision-making framework may result in regulatory risk, even where technically competent teams are in place.
 
The Supply Chain – A Critical Risk Area
One of the significant effects of the CRA is the extension of responsibility across the supply chain. A manufacturer placing a product on the EU market is responsible for the compliance of the entire product, including integrated components and third-party solutions.
In practice, this leads to:

• the need for traceability of the libraries and modules used
• stricter contractual clauses concerning cybersecurity and maintenance
• enhanced documentation requirements
• greater oversight of external developers and suppliers.

The use of open-source software does not relieve the manufacturer of responsibility when it is integrated into a commercial product. Therefore, dependency management becomes a key element of preparation for 2027.
 
Impact on Product Strategy
Integrating the requirements of the Cyber Resilience Act inevitably affects how products are developed and positioned.
In the short term, this may result in:

• longer development cycles
• additional costs for testing and documentation
• closer coordination between legal, technical, and management teams.

In the medium and long term, however, it creates predictability, reduces the likelihood of regulatory bottlenecks, and enhances trust among customers and partners.
For international companies, the standards introduced by the CRA may become part of their global product policy, even beyond the EU.
 
Sanctions and Market Risk
Non-compliance with the requirements of the Regulation may lead to significant administrative penalties.
For certain infringements, fines may reach up to EUR 15,000,000 or up to 2.5% of the undertaking’s total worldwide annual turnover, whichever is higher.
In addition to financial consequences, there is also:

• the risk of restrictions or prohibition on placing the product on the market
• product withdrawals
• reputational damage
• contractual liability towards customers and partners.

In this context, preparation for 2027 should be viewed as an integral element of overall regulatory and business risk management.
 
Security as a Competitive Advantage
The Cyber Resilience Act introduces a minimum cybersecurity standard for products on the EU single market. Organisations that go beyond this minimum may turn compliance into a strategic advantage.
Companies that can demonstrate:

• systematic vulnerability management
• clearly defined support periods
• transparency regarding architecture and updates
• formalised internal processes,

will be preferred partners for corporate clients and public contracting authorities.
 
Regulation (EU) 2024/2847 is not merely a technical regulation. It reshapes the way digital products are designed, managed, and placed on the market within the European Union.
The period until 2027 provides an opportunity for structured and strategic preparation. Organisations that actively use this period will reduce regulatory risk, strengthen their governance framework, and improve their market position in an environment where cybersecurity has become an integral part of business models.