Cyber Resilience Act published: cybersecurity becomes a CE-marking requirement

2024-11-20 · Publisher : Union européenne · Domain : Industry 4.0 & 5.0

Regulation (EU) 2024/2847, published on 20 November 2024, imposes cybersecurity requirements on all products with digital elements, including PLCs and industrial software. Reporting applies from 11 September 2026, full application on 11 December 2027.

### Background Published in the Official Journal on 20 November 2024 and in force since 10 December 2024, the **Cyber Resilience Act** (Regulation (EU) 2024/2847) imposes security-by-design requirements on all hardware and software products with digital elements placed on the EU market. Compliance will be shown by the **CE marking**. ### Timeline - **20 November 2024**: OJ publication; entry into force on 10 December 2024. - **11 June 2026**: provisions on notification of conformity assessment bodies (Chapter IV). - **11 September 2026**: obligation to report actively exploited vulnerabilities and severe incidents (Article 14). - **11 December 2027**: general application (essential requirements, technical documentation, EU declaration of conformity, CE marking). ### Why it matters PLCs, HMIs, IoT gateways, networked drives, engineering software: almost all of an industrial equipment maker's portfolio is in scope. Vulnerabilities must be handled throughout the support period (at least five years unless the expected use is shorter), security updates provided and software components documented. Some "important" or "critical" products require a third-party body. Engineering offices must build cyber risk analysis into the development cycle, relying on standards such as IEC 62443. ### Key takeaway The CRA turns cybersecurity into a product requirement, like electrical or mechanical safety: non-compliant equipment can no longer be sold in the EU after December 2027.

Tags : Réglementation, UE, Cybersécurité OT, CRA, Normes