The Word Manufacturer Now Means You

The EU Cyber Resilience Act entered into force in December 2024, and its definition of a manufacturer is wider than most boards assume. It covers any product with digital elements placed on the European market: a connected machine, an industrial controller, a medical device, a consumer gadget, or a piece of standalone software. If your product talks to a network, it falls in scope, and so do the importers and distributors who put it on the market.

For a family office or a Mittelstand owner, the uncomfortable part is the reclassification. A company that has built precision machines for three generations, and never called itself a software business, is now a regulated software vendor in the eyes of EU law. The rule also reaches beyond the bloc. A manufacturer based anywhere in the world that sells into the European market carries the same duties as one based in Frankfurt.

A 24-Hour Clock You Do Not Control

The first hard deadline is close. From 11 September 2026, an actively exploited vulnerability or a severe security incident starts a fixed reporting cascade through a single European platform. An early warning is due within 24 hours, a fuller notification within 72 hours, and a final report within 14 days of issuing a fix or workaround. The clock does not wait for your legal review or your communications plan.

That timing is the operational shock. The 24-hour window opens during the worst moment of an incident, when the information is incomplete and the instinct is to say nothing until the facts are clear. The Act removes that option. An organization that cannot detect, triage, and report a flaw inside a day will miss the deadline, not because it lacks goodwill, but because it never built the machinery to move that fast.

CE Marking, and a Fine Sized to Your Turnover

The broader obligations follow on 11 December 2027. From that date, a product with digital elements needs a CE marking that certifies it was built with security by design, ships without known exploitable defects, and will receive security updates across a defined support period. Compliance is not a one-time test before launch, it is a duty that runs for the supported life of every unit you have sold.

The enforcement carries weight. National market surveillance authorities police the rules, and Germany has already issued a first draft of the law to name its competent authority. Penalties for failing the core requirements reach 15 million euros or 2.5 percent of global annual turnover, whichever is higher. For a profitable mid-sized maker, the turnover figure is the one that should focus the room.

Read next: Is Your Cyber Defense Ready for Machine-Speed Attacks?  ·  Your Encryption Has an Expiry Date