Sector · CRA for connected-product manufacturers
CRA and Data Act for connected-product manufacturers
Manufacturers of connected products must now plan for both the CRA and the Data Act. If you manufacture, import or sell products with digital elements in the EU, such as IoT devices, connected industrial equipment or software, the Cyber Resilience Act and the Data Act change how you design, document and maintain your products.
Key regulations for manufacturers: CRA, Data Act and more
Cyber Resilience Act (CRA): what manufacturers must do
Regulation (EU) 2024/2847 requires security by design, vulnerability handling throughout the support period, technical documentation and the CE marking that attests the product’s cybersecurity. However, it does not apply all at once: for manufacturers, the CRA arrives in phases:
| When | What |
|---|---|
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents: early warning within 24 hours and notification within 72 hours. |
| 11 December 2027 | Full application, including essential requirements and CE marking. |
Data Act
Regulation (EU) 2023/2854 has applied since 12 September 2025. Since then, users of a connected product have had the right to access the data generated by its use and to share it with third parties. As a result, products placed on the market from 12 September 2026 must be designed so that this data is accessible easily and securely.
Radio equipment
If your product connects by radio (Wi-Fi, Bluetooth or mobile networks), since 1 August 2025 it must meet the cybersecurity requirements of Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive. However, the CRA is expected to replace them once it fully applies, so manufacturers should plan for both.
What manufacturers should prepare now for the CRA
- First of all, a vulnerability handling process with a reporting channel and defined deadlines.
- The software bill of materials (SBOM) for each product.
- The support period you will commit to and how you will then publish updates.
- Data access by design for products coming to market, since the Data Act requires it.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps manufacturers with the CRA
- A product inventory with components and versions, as well as the support period.
- The vulnerability register and the 24- and 72-hour reporting clock.
- Technical documentation and evidence, especially for the conformity assessment.
- Data Act obligations per product and per date of placing on the market, since the rules differ by date.
FAQ
Frequently asked questions
Does the CRA apply to software?
Yes, to products with digital elements, including software sold separately, with exclusions such as SaaS without an associated product and some sectors with their own rules, such as medical devices or vehicles.
What is the support period?
The time during which the manufacturer must handle the product’s vulnerabilities: as a rule at least five years, unless the product is expected to be used for less time.
What data must I provide under the Data Act?
The product data and related service data generated by its use, in the format in which it is generated and with the metadata needed to interpret it.
Other sectors: Banking and fintechInsurersPublic-sector suppliersEnergy and essential services
Shall we look at it with your own services?
We’ll show you the platform with a real case from your sector. No commitment, no sales script.
