Routers, cameras, industrial controllers, and app-controlled devices increasingly rely on software from a wide variety of vendors. A product may also contain open-source components.

This raises a practical question: who is responsible for the security of the entire product if a vulnerability is found in a component that the manufacturer did not develop itself?

The Cyber Resilience Act (CRA) changes the way we view this responsibility. Cybersecurity is no longer solely a technical issue. It becomes an integral part of product design, supplier management, and planning for the product’s entire lifecycle.

CRA—The First Obligations Are Already in Effect

The CRA will be fully implemented as of December 11, 2027, but some obligations took effect earlier.

As of September 11, 2026, manufacturers are required to report certain actively exploited vulnerabilities and serious incidents affecting the security of products containing digital components. Initial reports must be submitted within short timeframes—in certain cases, within 24 hours.

In practice, this means the process must be prepared in advance: who identifies the problem, who assesses its impact on the product, who makes the decision, and who is responsible for reporting it.

A manufacturer must know what its product consists of

This is one of the most important practical challenges arising from the CRA.

A product may contain the manufacturer’s own software, commercial solutions from other vendors, and open-source components. A vulnerability in any one of these can affect the security of the entire product.

The CRA requires manufacturers to exercise due diligence when integrating third-party components, including open-source components.

Therefore, the manufacturer should be able to determine which components are included in the product, who is responsible for them, and which products may be affected by a detected vulnerability.

Responsibility does not end on the day of sale

The CRA also changes the way we think about the product lifecycle.

The manufacturer will be required to address vulnerabilities and ensure the product’s security throughout the support period. As a general rule, this period is to be at least five years, unless the product’s expected useful life is shorter. If, however, a longer useful life of the product can reasonably be expected, the support period should reflect this.

This has direct business implications. The costs of monitoring vulnerabilities, preparing updates, and maintaining security can arise long after the product has been sold.

Therefore, these costs should be factored in as early as the design phase and when calculating the business model.

CRA should be reflected in contracts with suppliers

If a product’s security depends on third-party software, the manufacturer should be able to obtain information about an issue quickly enough to take corrective action.

Therefore, it is worth verifying whether contracts with suppliers specify, among other things:

• who reports vulnerabilities and by what deadline,
• who prepares patches and updates,
• how long the supplier provides support,
• how cooperation is organized in the event of an incident,
• who bears the costs and liability in the event of security issues.

After all, an external component does not mean an external problem. From the manufacturer’s perspective, the security of the entire product remains critical.

Cybersecurity Becomes Part of Product Liability

This change is not limited to the CRA alone.

The new EU directive on liability for defective products explicitly includes software within the definition of a product. Cybersecurity requirements may also be relevant when assessing product defects.

As a result, it is becoming increasingly difficult to treat product safety and cybersecurity as two separate issues.

Where to start preparing for the CRA?

First and foremost, a business should answer a few questions:

Do we know what components our products consist of?
Can we quickly determine which products are affected by a detected vulnerability?
Are our suppliers required to notify us of it in a timely manner?
Do they provide support for as long as we ourselves are required to support the product?
Do we know who in the organization will take action when a problem arises?

The answers help assess whether the company is prepared for the new requirements—not only formally but also operationally.

How can JLSW help?

JLSW assists businesses in determining the scope of the CRA’s application, analyzing the obligations of manufacturers, importers, and distributors, reviewing contracts with software and component suppliers, and preparing procedures for vulnerabilities, incidents, and updates.

Product cybersecurity goes beyond securing the code. It encompasses how the product is designed, delivered, and maintained throughout its entire lifecycle.