The Cyber Resilience Act: law, guidance and FAQ.

Orientation: subject matter, scope and the central definitions (including "product with digital elements", "placing on the market", "substantial modification", "open-source software steward"). Classification of important and critical products and the relationship with general product safety.

• Article 1 – Subject matter
• Article 2 – Scope
• Article 3 – Definitions
• Article 4 – Free movement
• Article 5 – Procurement or use of products with digital elements
• Article 6 – Requirements for products with digital elements
• Article 7 – Important products with digital elements
• Article 8 – Critical products with digital elements
• Article 9 – Stakeholder consultation
• Article 10 – Enhancing skills in a cyber-resilient digital environment
• Article 11 – General product safety
• Article 12 – High-risk AI systems

Orientation: the core of the manufacturer's obligations (risk assessment, secure-by-design, vulnerability handling, support period, SBOM), reporting obligations and the single reporting platform, the roles of authorised representatives, importers and distributors, the manufacturer "fiction", and the special regime for open-source software stewards.

• Article 13 – Obligations of manufacturers
• Article 14 – Reporting obligations of manufacturers
• Article 15 – Voluntary reporting
• Article 16 – Establishment of a single reporting platform
• Article 17 – Other provisions related to reporting
• Article 18 – Authorised representatives
• Article 19 – Obligations of importers
• Article 20 – Obligations of distributors
• Article 21 – Cases in which obligations of manufacturers apply to importers and distributors
• Article 22 – Other cases in which obligations of manufacturers apply
• Article 23 – Identification of economic operators
• Article 24 – Obligations of open-source software stewards
• Article 25 – Security attestation of free and open-source software
• Article 26 – Guidance

Orientation: presumption of conformity where harmonised standards are applied, EU declaration of conformity, CE marking, technical documentation, conformity assessment procedures and support measures for SMEs/start-ups.

• Article 27 – Presumption of conformity
• Article 28 – EU declaration of conformity
• Article 29 – General principles of the CE marking
• Article 30 – Rules and conditions for affixing the CE marking
• Article 31 – Technical documentation
• Article 32 – Conformity assessment procedures for products with digital elements
• Article 33 – Support measures for microenterprises and small and medium-sized enterprises, including start-ups
• Article 34 – Mutual recognition agreements

Orientation: notification, requirements for notifying authorities and notified bodies, their operational obligations, and procedures and coordination. These provisions apply from 11 June 2026.

• Article 35 – Notification
• Article 36 – Notifying authorities
• Article 37 – Requirements relating to notifying authorities
• Article 38 – Information obligations on notifying authorities
• Article 39 – Requirements relating to notified bodies
• Article 40 – Presumption of conformity of notified bodies
• Article 41 – Subsidiaries of and subcontracting by notified bodies
• Article 42 – Application for notification
• Article 43 – Notification procedure
• Article 44 – Identification numbers and lists of notified bodies
• Article 45 – Changes to notifications
• Article 46 – Challenge of the competence of notified bodies
• Article 47 – Operational obligations of notified bodies
• Article 48 – Appeal against decisions of notified bodies
• Article 49 – Information obligations on notified bodies
• Article 50 – Exchange of experience
• Article 51 – Coordination of notified bodies

Orientation: powers of the market surveillance authorities, access to data and documentation, national and Union-level procedures for products presenting a significant cybersecurity risk, the safeguard procedure and coordinated control activities (sweeps).

• Article 52 – Market surveillance and control of products with digital elements in the Union market
• Article 53 – Access to data and documentation
• Article 54 – Procedure at national level for products presenting a significant cybersecurity risk
• Article 55 – Union safeguard procedure
• Article 56 – Procedure at Union level for products presenting a significant cybersecurity risk
• Article 57 – Compliant products with digital elements which present a significant cybersecurity risk
• Article 58 – Formal non-compliance
• Article 59 – Joint activities of market surveillance authorities
• Article 60 – Coordinated control activities (sweeps)

Orientation: delegated acts and comitology.

• Article 61 – Exercise of the delegation
• Article 62 – Committee procedure

Orientation: confidentiality, penalties (up to EUR 15 million or 2.5 % under Art. 64(2); the privilege for open-source software stewards applies only in respect of Art. 64(3)–(9)) and representative actions.

• Article 63 – Confidentiality
• Article 64 – Penalties
• Article 65 – Representative actions

Orientation: amendments to other legal acts, transitional provisions (in particular Art. 69(2) on legacy products and substantial modification), evaluation, and entry into force and application.

• Article 66 – Amendment to Regulation (EU) 2019/1020
• Article 67 – Amendment to Directive (EU) 2020/1828
• Article 68 – Amendment to Regulation (EU) No 168/2013
• Article 69 – Transitional provisions
• Article 70 – Evaluation and review
• Article 71 – Entry into force and application

Orientation: the technical core. Annex I sets the essential requirements, Annex VII the technical documentation, Annex VIII the conformity assessment procedures.

• Annex I – Essential cybersecurity requirements (Part I: product properties; Part II: vulnerability handling)
• Annex II – Information and instructions to the user
• Annex III – Important products with digital elements (Classes I and II)
• Annex IV – Critical products with digital elements
• Annex V – EU declaration of conformity
• Annex VI – Simplified EU declaration of conformity
• Annex VII – Contents of the technical documentation
• Annex VIII – Conformity assessment procedures