EU Cyber Resilience Act: What UK Businesses Need to Know Before Reporting Rules Begin

From 11 September 2026, new CRA reporting duties begin for in-scope organisations. For UK businesses that manufacture, import, distribute or sell connected hardware, software and digital products into the EU market, this is an important date to have on the radar.

The Cyber Resilience Act is designed to make cyber security a core part of how digital products are designed, developed, maintained and supported. It applies to connected hardware, software and digital products that are placed on the EU market.

In this blog, we explain what the EU Cyber Resilience Act means for UK businesses, the key CRA dates to know, and the practical steps organisations can take now to prepare.

What Is the EU Cyber Resilience Act?

The EU Cyber Resilience Act, often referred to as the CRA, introduces mandatory cyber security requirements for products with digital elements made available on the EU market. This includes many types of connected hardware and software, such as smart devices, operating systems, mobile apps, laptops and industrial IoT products.

The CRA is intended to raise the minimum standard for product cyber security across the EU market. Security needs to be considered before a product is launched, then managed through updates, vulnerability processes and clear support information for users.

The Irish National Cyber Security Centre has published a dedicated Cyber Resilience Act reporting resource, which outlines the key reporting duties, product scope and practical areas organisations need to consider. For UK businesses operating in this space, it is a useful starting point for reviewing upcoming responsibilities and planning the right next steps.

Why the Cyber Resilience Act Matters for UK Businesses

For UK businesses, the Cyber Resilience Act matters because it focuses on products made available on the EU market. This means a UK organisation may need to take action if it manufactures, imports, distributes or sells in-scope products into the EU.

Even where a business is not the manufacturer, the CRA may still influence supplier conversations, procurement checks, contractual requirements and customer expectations. In practice, organisations are likely to be asked clearer questions about how the technology they supply, integrate or rely on is secured and supported.

EU Cyber Resilience Act Key Dates

• 10 December 2024: The Cyber Resilience Act entered into force, beginning the transition period for businesses to prepare.
• 11 June 2026: Provisions relating to notifying authorities and conformity assessment bodies begin to apply.
• 11 September 2026: Mandatory reporting obligations begin. Organisations in scope will need to report actively exploited vulnerabilities and severe incidents affecting products with digital elements currently available on the EU market.
• 11 December 2027: The main technical product compliance rules apply, including the wider requirements for products with digital elements made available on the EU market.

Cyber Resilience Act Requirements: What Businesses Need to Consider

If your business operates in this space, now is the time to understand what the CRA could mean for your organisation. The exact impact will depend on your role in the supply chain, but the direction is clear: cyber security needs to be built into digital products from the start and managed throughout their lifecycle.

• Cyber security throughout the product lifecycle: Security should be considered from design and development through to maintenance, updates and end-of-life planning.
• Security by design and by default: Products should be built with appropriate security controls from the beginning, rather than relying on fixes later.
• Vulnerability handling and reporting: In-scope organisations need clear processes for identifying, confirming and reporting actively exploited vulnerabilities and severe incidents.
• Risk assessment and compliance: Businesses should understand which products are in scope, what evidence may be needed and where responsibilities sit internally and across the supply chain.
• Responsibilities for manufacturers, importers and distributors: Different organisations have different duties, so it is important to understand your role and take appropriate advice where needed.

Ahead of Cyber Security Awareness Month in October

Ahead of Cyber Security Awareness Month in October, the CRA is a timely reminder that cyber security is not just an internal IT issue. It is part of product quality, supplier assurance and business resilience.

For UK businesses, October is a useful opportunity to turn awareness into action. That means understanding which software, systems and connected products are critical to your organisation, how they are supported, what happens if a vulnerability is discovered and whether suppliers can clearly demonstrate good security practice.

Awareness campaigns are valuable, but they are most effective when they lead to practical improvements. The CRA highlights the importance of reviewing risk, strengthening supplier checks, improving incident response plans and keeping vulnerability management processes up to date.

How UK Businesses Can Prepare for the Cyber Resilience Act

Although the main technical product compliance rules apply from December 2027, the CRA reporting obligations start earlier. Businesses should use the time now to understand their exposure, prepare internal processes and speak to suppliers where needed.

• Identify whether your products, software, hardware or connected devices could fall within scope.
• Review suppliers and third-party products that are critical to your operations.
• Check contracts and procurement processes to understand how cyber security responsibilities are managed.
• Confirm whether products have clear support periods, update processes and vulnerability disclosure routes.
• Update incident response processes so teams know how vulnerabilities and severe incidents should be escalated and reported.
• Keep clear evidence of risk assessments, cyber security controls and ongoing product support.
• Work with an experienced IT or cyber security partner to identify gaps and prioritise the right next steps.

Cyber Resilience Is Becoming a Business Priority

The EU Cyber Resilience Act is part of a wider move towards stronger cyber security expectations across digital products, supply chains and day-to-day business operations. For UK businesses, the key question is not only whether the regulation applies today, but whether your organisation is ready for the expectations it creates.

By reviewing your technology estate, strengthening supplier assurance and building cyber resilience into everyday decision-making, your business can reduce risk, improve confidence and make better-informed decisions about the products and partners you rely on.

If your business needs help understanding how cyber resilience, supplier assurance or compliance requirements affect your IT environment, Optimising IT can support you with a practical review and clear next steps. Speak to our team to understand where your business stands and how to prepare with confidence.