EU Cyber Resilience Act forces manufacturers to tighten product security and compliance

The European Union's Cyber Resilience Act (Regulation (EU) 2024/2847) expands the definition of a product to include any digital components and the remote backend services that support it. Under the Act, manufacturers remain responsible for the security of the entire system throughout its lifecycle, must conduct risk assessments, document vulnerabilities, and provide support for at least five years, with sanctions possible for non‑compliance.

The regulation coincides with market pressure for more connectivity and functionality in devices, which increases code volume and the overall attack surface. Sectors such as automotive, aerospace and defence face higher costs, added process steps and greater liability as they must embed security from design through long‑term maintenance. Companies are hiring security engineers to manage compliance, perform vulnerability scans, coordinate incident response and apply standards such as IEC 62443, ISO/IEC 27001 and NIST guidelines.