The EU Cyber Resilience Act: Building Products Under Product Law

From 11 September 2026, manufacturers must report actively exploited vulnerabilities in their products within 24 hours. From 11 December 2027, software and connected hardware carry a CE mark for cybersecurity. Regulation (EU) 2024/2847 places connected products under the same machinery that governs toys and lifts, and most engineering teams have never worked under product law. This path follows the Regulation itself: what it covers and whom it binds, what Annex I demands of the product and of the manufacturer, how the reporting clocks run, and what evidence survives an inspection.