Cyber Resilience Act: EU Adopts New Law to Strengthen Digital Product Security

The European Union has adopted the Cyber Resilience Act, introducing EU-wide cybersecurity requirements for hardware and software products with digital elements, enforced via CE marking and applied across the product lifecycle—including design, development, and supply chain. Covering a broad range of connected devices (with exceptions for sectors already regulated), the regulation seeks to enhance consumer transparency, streamline compliance for businesses, and strengthen the EU’s cybersecurity ecosystem alongside NIS/NIS2 and the EU Cybersecurity Act. Following publication in the Official Journal, it enters into force after 20 days, with core obligations applying after a 36-month transition period and some provisions taking effect earlier.