The regulation addresses manufacturers and decides what a municipality can buy. The timeline, what is covered, the support period as the most useful line in the contract, and five questions for every supplier.
English · Read this paper in Svenska
The Cyber Resilience Act for buyers
The Cyber Resilience Act addresses those who manufacture and sell products with digital elements, and it decides what a municipality can buy, and when. For a purchasing organisation it is a procurement question: which requirements go into the tender documents, which answers to ask for, and what happens to the products already installed.
What it does
Sets security requirements across the whole lifecycle of products with digital elements: secure design, vulnerability handling, documentation and CE marking.
Why it reaches you
The requirements land with the supplier, and the delivery lands with you. A product that does not meet them cannot be placed on the market, and therefore cannot be bought.
What to do now
Write support period, vulnerability handling and a software component list into your tender documents at the next procurement.
The timeline
| Date | What happens | Source |
|---|---|---|
| 10 December 2024 | The regulation entered into force. | European Commission, Cyber Resilience Act, retrieved 20 Aug 2026 |
| 11 September 2026 | Manufacturers must report actively exploited vulnerabilities. | Same source |
| 11 December 2027 | The main obligations apply. | Same source |
The middle date is the one worth noting in a purchasing calendar: from that point a supplier has a standing reporting duty, which makes the question of how they handle vulnerabilities answerable rather than theoretical.
Read all of The Cyber Resilience Act for buyers
The rest of the paper is sent as a link to your address. It opens the text directly — no account, no password, and the address is used for nothing else unless you tick the box below.
Your address is stored so the paper can be sent, and to know which areas are being asked for. Nothing else is sent unless the box is ticked, and it can be stopped at any time.
Where this goes next
Want this applied to your organisation?
One call is enough to know if we're a fit.