What the Cyber Resilience Act means for connected equipment makers
Reporting obligations started on 11 September 2026; the rest apply from December 2027. What equipment makers have to be able to do, and how a platform helps.
The EU Cyber Resilience Act (CRA) applies to almost every product with digital elements sold in the EU, connected machines included. For equipment makers it turns things that were good practice (knowing what software runs on each unit, fixing vulnerabilities, shipping updates) into obligations with deadlines and fines. This is a summary, not legal advice; the sources are at the end.
The dates
- 10 December 2024: the CRA entered into force.
- 11 September 2026: reporting obligations apply, including for products already on the market.
- 11 December 2027: the main obligations apply to products placed on the EU market.
Reporting, since September 2026
When a manufacturer becomes aware of an actively exploited vulnerability in its product, or a severe incident affecting its security, it must report it through the CRA's single reporting platform:
- an early warning within 24 hours,
- a notification within 72 hours,
- a final report within 14 days of a fix being available for an exploited vulnerability, or within a month for a severe incident.
Penalties for breaching the CRA's obligations can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher.
What equipment makers need to be able to do
Behind the legal text are a few practical capabilities:
- Know what's on every unit. Which firmware and which components run on which machines, at which customers, so that when a vulnerability is published you can answer "are we affected, and where?" in minutes, not weeks.
- Ship fixes to the field. Security updates for the product's support period, delivered safely to machines in plants you don't control.
- Notice when something is wrong. Enough telemetry to spot exploitation or an incident, because the 24-hour clock starts when you become aware.
- Give every device its own identity, so one compromised unit doesn't compromise the fleet.
- Keep the evidence: who changed what, and when.
How a platform helps
Each of these is a building block we're designing Polythings around:
- Over-the-air updates with a software bill of materials for every release, so "which devices run the vulnerable version" is a query.
- Rollouts that stop themselves when devices start failing, so a security fix can go out fast without becoming the next incident.
- A certificate authority that gives each device its own short-lived certificate.
- Telemetry, alarms and audit logs kept as open tables, so the record is complete and yours.
If your products ship to EU customers, December 2027 is closer than it looks: firmware written today will still be in the field then. The roadmap shows when each of these arrives.
Sources
- European Commission, CRA reporting obligations
- Ireland's National Cyber Security Centre, EU Cyber Resilience Act
- Travers Smith, the CRA's reporting requirements are now live