The European Commission has published practical guidance to help manufacturers, developers, and businesses of all sizes meet their obligations under the Cyber Resilience Act.
The Commission acknowledges that digital products are part of everyday life in Europe – from baby monitors to smartwatches, from apps to computer programs. But while these products bring enormous benefits, the Commission says citizens and businesses deserve the assurance that they are protected from cyber threats.
The Cyber Resilience Act, in force since December 2024, sets clear and mandatory cybersecurity requirements across the full lifecycle of digital products.
The new guidance, part of EU ‘Omnibus’ efforts to cut red tape for business, is about making implementation work in practice, says the Commission. Rather than leaving companies – especially smaller ones – to navigate the rules alone, the Commission is stepping in early with clear, accessible, and actionable support.
The guidance addresses the questions stakeholders have been asking most, including:
- Clarifying when certain products fall within the scope of the Cyber Resilience Act, including remote data processing solutions and free and open source software
- What constitutes a ‘substantial modification’
- How support periods should be understood and applied
- How to meet reporting obligations and risk assessment requirements
Particular attention has been paid to microenterprises and SMEs, with 67 practical examples, a range of use cases, flowcharts and graphs, ensuring that the path to compliance is clear and proportionate, without unnecessary administrative burden.
The publication of this guidance is part of wider Commission efforts towards ‘simplification’ and effective implementation, including through the Digital Omnibus published in November 2025.
The Cyber Resilience Act’s main obligations apply from 11 December 2027, with reporting obligations already applying as of 11 September 2026. The new guidance – underlined by the Commission as ‘non-binding’ – gives companies the clarity they need to prepare now, confidently and efficiently.
