Cyber Resilience Act

Regulation (EU) 2024/2847, in force since December 10, 2024, targets those who make digital products, where DORA and NIS2 weigh on those who use them. The duty to report actively exploited vulnerabilities and severe incidents has applied since September 11, 2026, and the rest of the text applies from December 11, 2027. It sets essential security requirements for any product with digital elements placed on the Union market, from a home router to a commercial software library: design free of known exploitable vulnerabilities, secure configuration by default, vulnerability handling over an announced support period, and drawing up a software bill of materials, which the manufacturer need not make public. It requires the manufacturer to report actively exploited vulnerabilities and severe incidents. And it places all of it under the CE marking regime, hence under withdrawal from the market in case of breach. For insurance, two consequences emerge. Product liability underwriting gains an objective benchmark where it previously had only professional custom. And cyber loss experience should move upstream, a product defect becoming a regulatory breach by the manufacturer rather than mere negligence by the end user.