New Cyber Resilience Act: Key Changes for IoT by 2027

New Cyber Resilience Act: Changes for IoT and Connected Products Starting in 2027

Starting in 2027, any connected product sold in the EU will have to meet new cybersecurity rules defined by the Cyber Resilience Act (CRA). This law focuses on Internet of Things (IoT) and networked devices, emphasizing security-by-design, proper vulnerability management, and proof of compliance. If manufacturers do not meet these expectations, they could lose access to the EU market.

This change means that cybersecurity will no longer be just a competitive advantage. It will become a basic requirement for selling products. Two important dates, September 2026 and December 2027, mark when these new obligations will begin to take effect.

The Importance of the Cyber Resilience Act for Manufacturers

The CRA is already active, having been adopted in December 2024. It sets clear expectations for manufacturers of IoT and networked products. These expectations apply regardless of whether a company is based in the EU. If a connected product reaches the EU market—whether directly, through distributors, or online—the CRA rules must be followed.

Milestones to Remember

• September 2026: The first operational obligations kick in, requiring manufacturers to identify and report serious security incidents and vulnerabilities.
• December 2027: The main security requirements will become mandatory for new products with digital features.

What Happens in September 2026?

In September 2026, manufacturers need to show they can find and report any serious security issues or vulnerabilities in their products. While this does not stop products from being sold, it tests whether companies have proper security processes in place. This includes not just technical measures but also clear internal workflows for managing vulnerabilities.

Firms lacking a view of their software components might find it challenging to meet these new requirements.

Requirements Starting December 2027

When December 2027 arrives, the main security requirements will apply. This means that any new product with digital elements must meet specific baseline security standards. Manufacturers will need to show they follow secure design practices, manage vulnerabilities throughout the product’s life, and can provide security updates. Products that don’t meet these standards won’t be allowed in the EU market, no matter how well they function or how much demand there is.

Shifting Focus on Cybersecurity

This change represents a significant shift for many product teams. Cybersecurity will no longer be just an internal goal; it will be a requirement that affects the legality of selling products in Europe.

Operational Changes Manufacturers Should Consider

The Cyber Resilience Act aims to lead to two key outcomes: fewer vulnerabilities at product launch and better ongoing maintenance. To achieve this, manufacturers should consider three operational shifts:

• Security should be an integral part of product development, not an afterthought.
• Manufacturers must understand all components in their devices and be prepared to respond to emerging vulnerabilities.
• Organizations need to move beyond one-time security testing to continuous monitoring and reporting of security issues.

Case Studies: Preparing for the Cyber Resilience Act

To illustrate how companies are adapting, here are some examples of security work being done:

• Router Audit: A comprehensive router audit revealed necessary changes in design and configuration to minimize risks.
• Industrial Networking Equipment: In sensitive environments, maintaining security is crucial. Projects focused on ensuring devices can be reliably patched and maintained over time.
• Wireless Edge Devices: Testing a Wi-Fi access point helped identify weaknesses, which led to improved security measures before a key contract.

Practical Steps for Compliance

If you build or ship connected products, here are some practical steps to start preparing for the Cyber Resilience Act:

• Begin tightening your product designs and architectures.
• Document all software and hardware dependencies.
• Establish regular patching and maintenance routines.

The CRA raises the baseline for cybersecurity in the EU. By 2027, security will be essential for selling connected products, not just a matter of reputation. Companies that begin adapting early will face fewer disruptions than those that wait until the last minute.