Cyber Resilience Act and IoT: a 2026 startup walkthrough

Yes. If your connected device is sold in the EU and connects to a device or network, the Cyber Resilience Act (CRA) almost certainly applies to it. It also covers the remote data processing the device needs to work, such as its cloud backend. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026. The main obligations, including CE marking against the CRA's security requirements, apply from 11 December 2027.

This guide follows one fictional Dublin startup through each Cyber Resilience Act decision for an IoT product, in the order the team would face them.

Key takeaways

• Reporting obligations apply from 11 September 2026. Main obligations apply from 11 December 2027.
• Reporting covers products already on the EU market, including those placed on the market before 11 December 2027.
• The device's remote data processing, such as its cloud backend, is part of the product. Mobile apps are in scope too.
• Most products can be self-assessed. Important class II products need third-party assessment or, where available, an EU certification scheme. Critical products need a notified body.
• If you sell the product under your own name, you are the manufacturer, even when a contract manufacturer builds it.

What is the Cyber Resilience Act, and does it apply to IoT products?

The Cyber Resilience Act is the EU's horizontal cybersecurity law for hardware and software products. The summary prepared by the Commission services describes it as "a horizontal regulatory framework of the European Union (EU), which applies to hardware and software products ('products with digital elements') that are made available on the Union market" (CRA summary). That summary states that it does not represent the Commission's official position. The legal text prevails.

A product is in scope when its "intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network" (CRA summary). Almost every IoT product passes that test. The Commission's CRA page says the law covers everything "from baby-monitors to smart watches, from apps to computer programs". It sets mandatory requirements for "the planning, design, development and maintenance" of products, which will carry the CE marking, and national market surveillance authorities enforce them (Commission CRA page).

There are two main limits on scope:

• Non-commercial products are out. Products not supplied in the course of a commercial activity are not subject to the CRA.
• Some products covered by other EU law are excluded. Check Article 2 of the legal text for the list.

The key dates are:

Date	What applies	Source
10 December 2024	CRA enters into force	Commission
11 June 2026	Chapter IV on notification of conformity assessment bodies applies	CRA summary
11 September 2026	Article 14 reporting obligations apply	CRA summary
11 December 2027	Main obligations apply, including CE marking	Commission

The law itself is Regulation (EU) 2024/2847. On 27 July 2026 the Commission published practical guidance for manufacturers, developers and businesses of all sizes. It also maintains an implementation FAQ. Read both alongside this article.

Who is our hypothetical startup, and what are they selling?

Warmline is a fictional company. It is not a client, and this scenario is illustrative only.

Warmline is a three-person team in Dublin. It sells a Wi-Fi smart heating controller under its own brand, and a contract manufacturer builds the hardware. Customers set schedules in a mobile app, which talks to the controller through Warmline's cloud backend. Warmline sells in Ireland and across the EU, and plans to sell in the UK.

Component	What it does	Built by
Controller hardware	Switches the boiler, reads temperature, connects over Wi-Fi	Contract manufacturer, to Warmline's design
Firmware	Runs the controller, receives updates	Warmline
Mobile app	Scheduling and remote control	Warmline
Cloud backend	Relays commands, stores schedules	Warmline, on a public cloud

Step 1: Is the heating controller a 'product with digital elements'?

Yes. The CRA defines a product with digital elements as "a software or hardware product and its remote data processing solutions" (CRA summary glossary). The controller is hardware with a network connection, and Warmline supplies it commercially.

The backend matters too. 'Remote data processing' means processing designed by or under the responsibility of the manufacturer, "the absence of which would prevent the product with digital elements from performing one of its functions" (CRA summary). Without the cloud, Warmline's customers cannot change schedules remotely. On our reading, the backend is part of the product and falls inside the security work.

The app needs CRA work as well. The Commission lists mobile apps, alongside household appliances, among in-scope products (conformity assessment page). The pages we reviewed do not settle whether Warmline's app is treated as part of the controller or as a separate product. Check that against the legal text and the Commission guidance.

The controller also has a Wi-Fi radio, so check the EU's radio equipment rules and how they relate to the CRA (see Step 6).

Step 2: Which CRA category does it fall into?

The category decides how much outside scrutiny the product gets, and it depends on the product's core functionality. Where a product "has the core functionality of an important or critical product category", the manufacturer may not be able to self-assess (CRA summary).

Category	Commission examples	Conformity route
Default	Memory chips, mobile apps, smart speakers, computer games	Self-assessment allowed
Important class I	Listed in Annex III	Self-assessment only with harmonised standards, common specifications or an EU certification scheme
Important class II	Listed in Annex III	Third-party assessment or, where available and applicable, an EU cybersecurity certification scheme
Critical	Smart cards, secure elements, smart meter gateways (Annex IV)	Notified body required in any case

Sources: Commission conformity page and CRA summary. The Commission lists operating systems, anti-virus, routers and firewalls as important products. The technical descriptions of each category are in Implementing Regulation (EU) 2025/2392.

On our reading, a standalone heating controller does not appear among the named important or critical products, so it is probably default. Confirm this against Annex III and the implementing regulation before you rely on it. Take particular care if the device also acts as a hub, gateway or router for other devices. Routers are named as important, and smart meter gateways as critical.

Step 3: Which conformity assessment route applies?

For a default-category product, Warmline can assess itself. The Commission says "most products, such as household appliances, computer games or mobile applications, will be subject to a self-assessment by the manufacturer" (conformity page). The default route is the internal control procedure based on module A, set out in Annex VIII.

The assessment produces three things, as described in the CRA summary:

• Technical documentation, including the risk assessment and how the essential requirements are met. It must be available to market surveillance authorities.
• An EU declaration of conformity.
• The CE marking on the product.

If the product turns out to be important class II, you need third-party assessment or, where available and applicable, a European cybersecurity certification scheme (CRA summary). For critical products, the Commission's conformity page says a notified body is required in any case. CRA notified bodies will be listed on NANDO as they are notified. The CRA requires notified bodies to take SME size into account, "including in relation to fees" (CRA summary).

Class I self-assessment depends on harmonised standards, common specifications or a certification scheme, so check what exists for your category. The CRA summary links to the Commission's standardisation page for this work.

Step 4: What security-by-design work lands on each team?

The work starts with a cybersecurity risk assessment. That assessment must be taken into account across "planning, design, development, production, delivery and maintenance", and it must be recorded in the technical documentation (CRA summary). The detailed essential requirements are in Annex I of the Regulation, so read Annex I in full. The checklist below covers what the Commission summary confirms. Items marked as advice are our engineering suggestions, not legal requirements.

Whole product

• [ ] A risk assessment covering the device, its firmware and its remote data processing, stored in the technical documentation. Cover the app too, whichever way it is classified.
• [ ] A support period decided by the manufacturer, with its end date (month and year) clearly specified at the time of purchase.
• [ ] Vulnerability handling throughout the support period, in line with Annex I.

Firmware and hardware

• [ ] An inventory of every third-party and open-source component, so you can show due diligence that "those components do not compromise the cybersecurity" of the product. Advice: a software bill of materials (SBOM) is one practical way to keep this. Check Annex I for the exact requirements.
• [ ] Advice: plan a secure update path early, because fixing vulnerabilities in devices already in homes depends on being able to deliver updates.
• [ ] A product identifier on the device: type, batch or serial number, or another element allowing its identification.

App and cloud

• [ ] Backend services included in the risk assessment, because they count as remote data processing.
• [ ] A dependency inventory for the app and backend, as for the firmware.

Labelling and user information

• [ ] Name, trademark, postal address, email or other digital contact, and website where applicable.
• [ ] Annex II user information, including the support-period end date.

Hephaestus's build stage covers embedded firmware, PCB and electronics, cloud and manufacturing work for connected products.

Step 5: What must be reported after launch, and how fast?

From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products (Commission reporting page). There are three stages:

1. Early warning: within 24 hours of becoming aware.
2. Full notification: within 72 hours.
3. Final report: no later than 14 days after a corrective or mitigating measure is available for an actively exploited vulnerability, or within a month of the 72-hour notification for a severe incident.

You report once, through the CRA Single Reporting Platform. ENISA operates the platform, and it has been operational since 11 September 2026 (reporting page; ENISA platform page). The report goes to the CSIRT of the Member State where you have your main establishment, which for Warmline is Ireland. Unless exceptional circumstances apply, the report is shared with ENISA at the same time.

The clock is already running for products already in customers' homes. Reporting applies to "all products with digital elements that have been made available on the Union market, including those already placed on the market before 11 December 2027" (CRA summary). Our advice is that Warmline should have a named owner, a platform account and an out-of-hours routine in place before its first unit ships. The law does not spell these out, but a 24-hour deadline is hard to meet without them.

Step 6: What changes if the startup also sells in the UK?

The CRA is EU law, so a UK launch needs its own check. For Great Britain, look up the UK's consumer connectable product security rules under the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 in the official UK government guidance for manufacturers. We have not summarised its requirements, dates or penalties here. Warmline is based in Ireland, so it should also confirm which rules apply to sales into Northern Ireland, which this article does not cover.

Inside the EU, the controller's Wi-Fi radio means Warmline should also check the EU's radio equipment rules, including any cybersecurity requirements, and how they relate to the CRA. We have not verified those details for this article. Check whether the Commission's CRA FAQ and guidance address your case.

A practical checklist for a two-market launch:

• [ ] Confirm the UK security requirements from official sources and map them against your CRA work. Some of the work, such as vulnerability intake and a published support period, may be reusable, but confirm this rather than assume it.
• [ ] Confirm which evidence or statement must accompany the product in the UK.
• [ ] Confirm the EU radio equipment requirements that apply to Wi-Fi products, and the applicable standards.
• [ ] Keep one technical file, with market-specific sections.

What does the CRA timeline look like from prototype to launch?

Work back from the fixed dates. The order below is our suggestion, and it matters more than the exact months.

1. Now: name a security owner and set up vulnerability intake and access to the Single Reporting Platform. Reporting already applies to products on the market.
2. Before design freeze: confirm the product category against Annex III and Implementing Regulation 2025/2392.
3. During design: carry out the risk assessment, then choose the update mechanism and secure configuration based on it.
4. During build: keep component inventories for the firmware, app and backend up to date on every release.
5. Before manufacturing: decide the support period and make sure its end date is clearly specified at the time of purchase, for example on your sales pages.
6. Before placing on the market: complete the technical documentation and the EU declaration of conformity, and affix the CE marking. This is required for the main obligations from 11 December 2027. For products already on sale before that date, check the transitional rules in the legal text and the Commission FAQ.
7. After launch: monitor vulnerabilities, ship fixes during the support period, and report at 24 hours, at 72 hours and by the final deadline.

What if the device also has an AI feature?

An AI feature may bring EU AI Act obligations on top of the CRA, so check both laws and how they interact. A heating-optimisation model may raise no AI Act obligations at all, but that depends on what it does. Start with whether the EU AI Act applies to your business. If the feature could be high-risk, work through our high-risk AI checklist. For the interaction between the two laws, rely on the legal texts and official guidance rather than secondary summaries.

Frequently asked questions

Do open-source components in my firmware make me responsible for them?

Yes, in the sense that you must exercise due diligence so that third-party components, including open source, do not compromise your product's cybersecurity (CRA summary). Open-source software stewards have their own obligations under Article 24 and are not subject to CRA penalties. Their reporting obligations start on 11 December 2027 (reporting page). None of this changes your obligations as the manufacturer.

Does the CRA apply to a cloud-only product with no device?

The CRA covers a product's remote data processing, meaning cloud services without which the product cannot perform one of its functions. The summary pages do not settle whether a standalone SaaS service with no product attached is in scope. Check the legal text and the Commission's CRA FAQ for your case.

My device is already on sale. Does the CRA affect it?

Yes, for reporting. Reporting obligations apply to products made available on the EU market, including those placed on the market before 11 December 2027 (CRA summary). For the other obligations, check the transitional provisions in the legal text, including how substantial modifications are treated.

How long must my support period be?

The manufacturer determines the support period, and its end date, including month and year, must be clearly specified at the time of purchase (CRA summary). The summary does not cover how long the period must be. Check the legal text for any further rules before you commit to a figure.

Who is the manufacturer if a contract manufacturer builds my device?

You are, if you market the product under your own name or trademark. The CRA's definition of manufacturer includes a person who has products designed, developed or manufactured and markets them under its name or trademark (CRA summary). Your supply contract should give you the component and process information you need for the technical documentation.

What are the penalties for non-compliance?

National market surveillance authorities enforce the CRA (Commission CRA page). We have not quoted fine levels. Read the penalties provisions in the Regulation text on EUR-Lex. Under the CRA, conformity assessment, the EU declaration of conformity and the CE marking come before a product is placed on the EU market (CRA summary).

If you are planning a connected product and want to walk through these steps for your own design, book a free 30-minute call with Hephaestus.

Cover photo by MART PRODUCTION on Pexels.