Does the EU Cyber Resilience Act apply to my firmware?

Short answer (it depends): Firmware is part of the device PDE. Whether you (the firmware supplier) or the device brand carries manufacturer duties depends on who places the product on the market; as a component supplier you still face due-diligence requests from customers.

What it means for a firmware

• If you sell firmware as a standalone product to the EU market, you can be a manufacturer in your own right.
• If you supply it as a component, expect your customers to demand SBOMs, update commitments and vuln contacts.
• Integrators must exercise due diligence on third-party components, including firmware.
• Long device lifetimes make the support period central.

Key dates

• 11 Sep 2026: reporting of actively exploited vulnerabilities and severe incidents (ENISA Single Reporting Platform) — applies to products already on the market.
• 11 Dec 2027: main obligations (security requirements, vulnerability handling, support period, CE marking).

FAQ

• I’m based outside the EU? Making your firmware available to EU users can still bring you in scope.
• What docs would I need? Typically a CVD policy, security.txt, intake page, reporting runbook, support-period statement, risk assessment.

Related: 24h reporting for firmware · CVD policy

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30