Cross-sector · EU
Cyber Resilience Act
Every product with digital elements sold in the EU must be secure by design and stay that way.
ForHeads of product security at hardware and software makers selling in the EU.
What’s changing, and when
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents, including for products already on the market. From 11 December 2027, secure-by-design requirements, vulnerability handling and conformity apply to every product in scope.
- Sep 2026 Vulnerability and incident reporting starts
- Dec 2027 Main obligations apply
Why it can’t happen in one step
Reporting is already live while the design duties come later, and every product line, update pipeline and supplier has to be brought up to standard in turn.
How Polymonial carries you across
- Updates and products your customers can trust are genuine.
- Reports reach only the authorities entitled to them.
- Product security stays current as standards change.
Trust that travels.
Secure, trusted and under your control.