EU cyber law puts product makers on the hook beyond launch

The EU’s new rules reach far beyond paperwork, requiring manufacturers to assess risks, fix vulnerabilities and support connected products throughout their expected lifetimes.

The European Union’s Cyber Resilience Act is reshaping how manufacturers think about connected products, software and long-term support. According to the regulation itself, products with digital elements now carry mandatory cybersecurity duties that cover secure design, risk assessment, vulnerability handling, technical documentation and security updates. The measure does more than set a general expectation of better security: it places responsibility squarely on manufacturers across the product lifecycle, from development through to support and remediation.

One reason the Act is already causing confusion is that it is broad by design. The European Commission’s implementation guidance says the rules apply to hardware and software placed on the EU market, including separately supplied components, while ENISA’s technical mapping shows that compliance is not just a matter of compiling paperwork. A software bill of materials can be useful, but it is only one element of a wider security programme that also requires monitoring, testing, disclosure processes and active vulnerability remediation. In other words, documentation helps, but it does not in itself satisfy the law.

Several persistent assumptions about scope are misleading. The regulation is not limited to critical infrastructure, and the Commission’s guidance, alongside ENISA’s analysis, makes clear that the framework reaches a wide range of consumer and industrial devices. The legal text also sets a support-period principle that is tied to the expected lifetime of the product, with five years acting as a minimum baseline rather than a universal ceiling. That distinction matters for products expected to remain in use for much longer, including industrial and embedded systems.

Open-source software remains another area where the Act is often misunderstood. The Commission’s dedicated page on open source explains that free and open-source software can fall within scope when it is supplied in the course of commercial activity, while the legal text also draws a line around open-source software stewards and other contributors working outside that commercial context. Even so, where a manufacturer uses open-source components inside a commercial product, the manufacturer retains the compliance burden for the finished device. The duty does not move upstream simply because the code originated in a community project.

The same caution applies to cloud-based services. A pure software-as-a-service offering may sit outside the Act, but legal analysis published by DLA Piper notes that the boundary becomes less clear when a cloud backend is essential to a product’s core function. For connected devices, packaging, marketing and technical dependence on remote processing can all affect the assessment. That is why the Act’s risk categories and conformity routes matter so much. ENISA says lower-risk products may rely on manufacturer self-assessment, while more sensitive categories face tighter scrutiny and, in some cases, third-party evaluation. For manufacturers, the practical lesson is simple: the Cyber Resilience Act is not a single checklist, but a regulatory framework that requires careful classification, evidence-based engineering and continued support.