Cyber Resilience Act: what the regulation changes for the firmware of a connected product
Regulation (EU) 2024/2847, known as the Cyber Resilience Act, sets cybersecurity requirements over the whole life cycle for manufacturers of products with digital elements: secure design, vulnerability handling, security updates and documentation. Vulnerability reporting has applied since 11 September 2026, the rest of the regulation applies from 11 December 2027.
Regulation (EU) 2024/2847, known as the Cyber Resilience Act, sets cybersecurity requirements over the whole life cycle for manufacturers of products with digital elements: secure design, vulnerability handling, security updates and documentation. Vulnerability reporting has applied since 11 September 2026, the rest of the regulation applies from 11 December 2027.
Which products are covered?
Regulation (EU) 2024/2847 covers "products with digital elements" made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect, logical or physical data connection to a device or network. A connected device and its firmware fall within this scope. Article 2 provides exclusions, for example for medical devices under Regulation (EU) 2017/745: check your case against the text.
What is the timeline?
According to Article 71 of the regulation, published in the Official Journal on 20 November 2024:
- 11 June 2026: the provisions on conformity assessment bodies (Chapter IV) apply;
- 11 September 2026: the manufacturers' reporting obligations (Article 14) apply: actively exploited vulnerabilities and severe incidents, to be notified to the coordinating CSIRT and to ENISA;
- 11 December 2027: the whole regulation applies.
What does it change for firmware?
The essential requirements are set out in Annex I of the regulation and apply on the basis of a cybersecurity risk assessment. For firmware, they mean in particular:
- placing on the market without known exploitable vulnerabilities, with a secure by default configuration;
- protection against unauthorised access, and confidentiality and integrity of data;
- the ability to fix vulnerabilities through security updates;
- vulnerability handling throughout the product's support period.
Article 13 sets a support period of at least five years, or equal to the expected use time if that is shorter.
Is an SBOM required?
Yes. Annex I requires manufacturers to identify and document the components of their products, including by drawing up a software bill of materials (SBOM) in a commonly used and machine-readable format, covering at least the top-level dependencies. Generating the SBOM on every build, rather than by hand, keeps it up to date.
And the RED directive?
For radio equipment, Directive 2014/53/EU (RED) already applies. Its Delegated Regulation (EU) 2022/30 makes cybersecurity requirements (Article 3(3), points d, e and f) mandatory for some radio equipment, in particular internet-connected equipment. It has applied since 1 August 2025, the date set by Delegated Regulation (EU) 2023/2444. A connected radio device is therefore covered today by the RED, and will be by the CRA.
Where to start?
- List the products concerned and their software components.
- Set up SBOM generation and vulnerability monitoring.
- Check that each product can receive a signed security update.
- Prepare the reporting process required by Article 14.
- Build up the technical documentation.
This guide summarises the text; it does not replace legal advice. To qualify a specific product or choose a conformity assessment procedure, consult a regulatory adviser or a notified body.
How we can help
Picodev handles the firmware side of compliance: secure communication, signed updates, SBOM and documentation.
Related service: Embedded software