Regulatory scoping for the EU Cyber Resilience Act
The Cyber Resilience Act regulates the product, not the network: any product with digital elements placed on the EU market carries secure-by-design, vulnerability-handling, and reporting duties. The phased timeline is the trap — reporting obligations land in September 2026, more than a year before the December 2027 main date.
Regulations Magist tracks for this vertical
Coverage of these newer regimes is published as draft and reviewed on a rolling basis.
Questions that determine your footprint
Is your product a "product with digital elements"?
Hardware and software whose use involves a data connection to a device or network can fall within CRA scope; standalone distributed software is typically caught while pure remote services are largely carved out.
Have you stood up a vulnerability-reporting pipeline?
The CRA reporting obligation applies from September 2026, ahead of the main 2027 date, so a coordinated vulnerability disclosure process and incident-notification path can be the first thing that needs to exist.
Can you commit to a defined support period?
A published support period and free security updates are binding representations under the CRA essential requirements, so the commitment typically needs to match what the team can actually staff.
See exactly which of 155+ regulations apply to your eu cyber resilience act product.
Magist is an instrument, not a consultancy. It does not sell compliance services or take payment from vendors for placement; the analysis is the same for everyone.
Magist provides legal information, not legal advice. Consult a licensed attorney.