Cyber Resilience Act
Does the new EU cyber law apply to your product?
If your company sells anything with software in it that connects to anything — a network, a phone, a cable, a companion app, a cloud back-end — it probably does, wherever in the world your company sits. Eight steps tell you where you stand, and the answer names the article behind every line of it.
Two minutes, no sign-up, answer on screen. Leave an email only if you want it as a PDF.
What you make
Step 1 of 8
What we do, and what stays yours
We are engineers, and we promise two things. The first is the whole of what we sell, not a slice of it: the scoping, the changes to your build, the reporting policies and plans, the paperwork that falls out of them, and the monitoring set up in an account you own. (The bigger job for the December 2027 date, Market Ready, is off our list at the moment and we say why further down.) The second is the price. A fifteen-person manufacturer can afford all of it, and we charge for the judgement rather than for the typing.
What we can do is help you become compliant. What nobody can do is take the duty off your hands: the law puts it on the company whose name is on the product, and that is you. Here is the line, before you read anything else.
What we do
Our published rules answer where you stand, and a named engineer signs a written reading of them. We look at your code with our tools and tell you what is missing. We propose the build changes, write the policies, plans and paperwork with you, and set up the monitoring you will run afterwards, in your own account. A named engineer reads and signs every document you get.
What stays yours
You remain the manufacturer. The final call on whether the law reaches your product, and which group it is in, is yours: our memorandum is our reading of the rules, not a ruling. You decide what to change and when, your engineers merge the changes into your own code, you sign your declaration, you put the CE mark on the product, and you decide whether an event has to be reported and send the report. You watch your own product too: the tool is in your account, the alerts go to your people, and the clock is yours. When a component you ship turns up on a public list of weaknesses under attack, that is a signal, not a verdict.
You can also overrule us. Every recommendation is yours to take or to leave: we put ours in writing, you record your decision beside it in the log the agreement gives you, and a year later both are on the record and the choice reads as yours. Leave one unanswered for ten business days and it counts as declined — the log says what happened, not what we hoped.
What we are not
We are not a law firm, a certification body, or your authorised representative in the EU. We do not give legal advice, sign your declaration, put the CE mark on anything, issue a certificate, or promise that every weakness in your product will be found. We do not watch your product, we are not sent your alerts, and nobody here is on call. Nobody can tell you in advance what view an authority will take, and we do not pretend to. If you need a representative in the EU, we tell you what one does and what that market charges; choosing one is yours.
A manufacturer may appoint an authorised representative in the Union by written mandate; the Regulation does not oblige non-EU manufacturers to appoint one.[Art. 18]Two dates, and they follow the product
The reporting duty applies from 11 September 2026. If a weakness in your product is being exploited, you have to tell the authorities, and fast. The first two filings are due without undue delay and in any event within the outer deadline — the hour figures are backstops, not an allowance to wait. For an actively exploited vulnerability: an early warning without undue delay and in any event within 24 hours of becoming aware, a vulnerability notification without undue delay and in any event within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available.[Art. 14(2)] A serious incident affecting the security of the product is a second trigger, with its own test and its own clocks, and it does not have to be an attack: a bad update or a misconfiguration can meet it. An incident that has an impact on the security of the product counts as severe, and so has to be reported, if either of two things is true: it harms, or is capable of harming, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or it has led, or is capable of leading, to malicious code being introduced or run in the product or in a user's own systems. Either limb on its own is enough, and "capable of" is enough — the duty does not wait for harm that has already happened. This test is for severe incidents only; it never applies to the vulnerability side.[Art. 14(5)] For a severe incident the first two filings carry the same two-part standard: an early warning without undue delay and in any event within 24 hours of becoming aware, and an incident notification without undue delay and in any event within 72 hours. The final report is due within one month after the incident notification is submitted — the month runs from the filing, not from the 72-hour deadline.[Art. 14(4)] The authorities are not the only people you have to tell, either — the users the product affects have to hear from you as well.
After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer must tell the users it affects — and where appropriate all users — about it, and where needed about the steps they can take to limit the damage, in a machine-readable form where that is appropriate. There is no fixed deadline: the standard is that it is done in a timely manner, and if the manufacturer does not, the CSIRT may tell users itself.[Art. 14(8)]From 11 December 2027, the rest applies: how the product is built, the paperwork behind it and the CE mark. A product that does not meet the rules cannot be sold in the EU.
The duty follows the product into the EU market, not your postcode. A maker in Manchester, Boston or Taipei that sells into Europe carries the same duties as one in Lyon, and the rules follow what your company does rather than how big it is.
Making a product available on the market means supplying it for distribution or use on the Union market in the course of a commercial activity, whether it is paid for or free, and placing on the market is the first such supply. Because the test is supply onto the Union market, a seller established outside the EU is caught in the same way as one inside it, and the size of the company makes no difference. The Regulation does not define "commercial activity" itself; the examples usually quoted for it come from the recitals, which guide interpretation rather than bind.[Art. 3(21), Art. 3(22); recitals for the commercial-activity examples]Fines reach €15,000,000 or 2.5% of worldwide annual turnover, whichever is bigger. That is the ceiling, not the price list: what an authority actually asks for has to take account of how serious it was and how big you are. These amounts are ceilings, not tariffs. In setting the amount in an individual case the authority must take account of all the relevant circumstances and give due regard to the nature, gravity and duration of the infringement and its consequences, to any fine already applied by the same or another authority for a similar infringement, and to the size and market share of the operator — with microenterprises, small and medium-sized enterprises and start-ups named expressly.[Art. 64(5)] As the Act was corrected in July 2025, no administrative fine applies to a manufacturer that counts as a microenterprise or a small enterprise for missing the 24-hour deadline on an early warning — either about a weakness under attack or about a serious incident. Because the correction moved the carve-out to start at paragraph 2, it reaches the largest band, 15 million euro or 2.5% of worldwide turnover, which is where a reporting failure sits; before the correction it did not. Read the limits with it: the two 24-hour early warnings only, not a failure to report at all and not the 72-hour notification or the final report; microenterprises and small enterprises only, not medium-sized ones; and it removes the fine, not the duty, so an authority can still order corrective or restrictive measures and a customer or importer will still ask. A second limb of the same paragraph covers open-source software stewards, and it is wider: no administrative fine at all, for any breach of the Act.[Art. 64(10) as corrected by OJ L, 2025/90555, 2.7.2025 ("paragraphs 2 to 9"); Art. 64(10)(a) with Art. 14(2)(a) and Art. 14(4)(a); Art. 64(10)(b) for stewards; Art. 64(2) for the band now reached; Art. 64(9) for fines sitting alongside corrective and restrictive measures] And the first pressure usually comes long before any of that, from a customer or a tender asking you for evidence.
What you get from us
You find out where you stand
Whether the law covers each product and version, which group it falls into, which dates apply to you and what to do first. In writing, signed by a named engineer.
You get it set up, not written up
We propose the build changes as a change your own engineers review and merge, and we write the policies, the plan and the paperwork around them. A slide deck is not a deliverable here.
You end up watching it, and owning the tool
We help you choose a monitoring tool, set it up in an account you own against your own component list, send the alerts to your own people and hand you one page saying what to do when one arrives. Then we give you the keys. You watch your own product from that day on, on a tool that keeps working whether or not you ever hear from us again.
How the work actually happens
Almost all of it is in writing. You do your part when it suits your week; we do ours and hand it back. Nothing sits waiting for a slot in a shared diary.
You answer, in your own time. We send one short brief: read access to your repository, who owns what, and a handful of questions. Most teams finish it in about an hour, spread over a few days.
We work in ours. The scanning, the drafting and the paperwork happen on our side, outside your working day. Each piece comes back in writing with a plain summary and one question: is this right?
You approve in writing. Every deliverable arrives with a decision to take and ten working days to take it. Saying yes needs no meeting.
You rehearse it once, yourselves. We send the exercise and the script; your team runs it on an afternoon that suits you and sends us the notes. We read them and write back what to change.
Where a call earns its place
Calls are for the things writing does badly: the first conversation about what it takes, a judgement call, a bad day. There are never many times on the calendar — we open the hours we can genuinely hold, a few at a time — so writing is usually the faster route. Calls are not how the work gets done, and that is deliberate — it is what keeps your engineers out of meetings and the price where it is. Written questions get an answer within one working day. This is not a service desk: nobody here is on call, and we would rather say so than promise a phone that is always answered.
What you can run yourself afterwards
You should not need us in a year. Everything we set up — the monitoring included — runs on tools you own, is written in the words your team uses, and needs no compliance department to operate.
One page to follow when something happens
Who is told, what they check, what the first message says, who sends it. It fits on a page because someone has to be able to use it at eight in the morning.
A release that produces its own evidence
Every time your team makes a new release, the list of what is inside your product comes out of that same process, automatically, and the release stops if it does not. Nobody has to remember.
A folder that stays where you left it
Your paperwork sits in your own systems, in the structure the law asks for, with the evidence already filed against each part. Keeping it up to date is a filing job, not a project.
What it costs
Six things are on sale. Here are the four most companies start with: one is the package for the reporting duty, one leaves you watching your own product, and two are ways to start without committing to anything.
- To find out whether the law reaches you at allAutomated scope checkFree
- To know where you stand, in writingScoping and classification memo€900per unit
- To be able to report, from now onReporting Ready€3,500per unit
- To watch your own product, on your own toolMonitoring set-up, in your own account€1,500per unit
The other two are for bigger teams: an engineer-led gap review that measures your product against the requirements one by one, and a half-day with your engineers. Both are priced on the services page, alongside these four.
There is a fifth piece of work — Market Ready, the one for the later date — and it is not on that list at the moment. The deadline is settled law and so are the duties The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)] — what has not been published is the European standard the work would be measured against. As at 10 September 2026, no harmonised standard for the Cyber Resilience Act had had its reference published in the Official Journal, so the presumption of conformity that comes with a harmonised standard was not available and our controls are versioned against the drafts. This is a point-in-time check: it must be re-read and re-dated before it is quoted anywhere, because the day a reference is published the sentence stops being true.[Regulation (EU) 2024/2847 Art. 27(1) — the presumption attaches on publication of the reference in the Official Journal by the Commission, not on adoption by CEN-CENELEC, so the page in source_url cannot evidence an absence from the Official Journal and is the wrong source for this row. The value is the date we last checked, not a figure from the provision.] We will not charge anyone for a technical file built against a draft that can still move, so we have taken it off the list rather than price it. It comes back when those references are published, and we are not inventing a date for that. The reasons, with the sources, are on the pricing page.
Whatever you pay us comes off Market Ready in full — not a percentage and not a voucher — and the credit never expires. We hold today's price for you as well, and if Market Ready never comes back the credit goes against anything else we sell. All of it is in the agreement you sign, with the limits stated: see what you pay comes off, and it never expires. Every price is published before you talk to us, and it is one euro price wherever your company is. Nothing on that list is monthly and nothing renews by itself. What each one includes, and what it leaves out, is on the pricing and services pages.
What you are paying for
At those prices a fifteen-person manufacturer buys all of what is on the list, not the slice it can afford. What you are paying for is the judgement: your component list, your reporting policy, your handling procedure and your build changes come back to you as finished work, and an engineer reads every line and puts their name on it before you see it.
Those signatures come from engineers who have shipped software in five Horizon Europe projects — VOXReality, UTTER, CORTEX2, ResilMesh and PoliRuralPlus. We put our own product through this work before selling it to anyone, and the result is public on the proof page.
What the price does not include is anyone here watching your product, and that is deliberate. Anything a consultancy watches for you is people's time on a retainer, so it always ends up expensive. A monitoring tool in your own account costs a fraction of that, it does the same watching, and it does not stop the day you stop paying us. Setting it up once and showing your team how to run it is both the cheaper arrangement and the honest one — you are the manufacturer, so the watching was always going to be yours.
We work in English, in every country the law reaches. Your code stays in Europe and is never used to train anything.
If something we deliver is not right
Tell us inside the ten-business-day acceptance period that a deliverable does not match what we agreed, and we correct it and deliver it again at no charge. For twelve months after delivery, the same free correction covers a deliverable that falls short of the care and skill we owe you — including one your own customer or a distributor turns down for a reason inside the agreed scope.
What that correction cannot reach is a decision you took against our advice: we stand behind our own work, not behind a choice we recommended against. Nobody can promise the view a market surveillance authority will take of your file either, and we do not. The full wording is on the services page.
Not sure where you stand?
Start with the free check: the published rules answer whether the Act reaches your product, it costs nothing, and the answer is yours to keep. What it takes to be ready — in what order and at what price — is the next question. The last step of the check is where you ask it: thirty minutes with an engineer, and no slides. If you would rather not book anything, write — we answer within one working day. You do not need a call to get a price: every price is published.