Cyber Resilience Act — general application
Date to be confirmed · application
What changes?
Meet applicable secure-product, vulnerability-handling and conformity-assessment requirements for covered products.
Who is affected?
EU-market manufacturers and relevant economic operators of covered digital products, including small software firms
When?
Date to be confirmed. Pure SaaS without the regulated remote-product relationship is not automatically in scope.
What to do
- Check whether your business matches this scope: EU-market manufacturers and relevant economic operators of covered digital products, including small software firms
- Implement secure-development and vulnerability handling, technical documentation and required conformity assessment.
- Confirm exemptions, thresholds and transitional arrangements in the linked primary source before implementing changes.
- Assign a responsible person and keep evidence of your applicability assessment and preparation.
Existing tools and providers
Snyk
Primary source
Cyber Resilience Act 2024/2847 (CELEX 32024R2847)
Checked 11 October 2026. A fresh date confirmation was not established. Do not rely on a date from an older summary.