European Commission issues guidance on Cyber Resilience Act

The European Commission approved on 27 July 2026 a detailed, non‑binding guidance document for the Cyber Resilience Act (Regulation (EU) 2024/2847). The 83‑page guide contains 67 worked examples and five flowcharts and will be used by market‑surveillance authorities and notified bodies when interpreting the regulation.

The guidance clarifies that the Act applies to products with digital elements that have a data connection, distinguishing between software that is installed on a device, web‑based applications, and source‑code licences. It notes that a downloadable game client falls within scope, whereas a browser‑only game does not. It also defines the moment a software version is placed on the market, affecting all copies of that version.

Aimed at manufacturers, programmers and companies of all sizes – especially small and medium‑sized enterprises – the document explains obligations such as incident notification, risk assessment, support periods and the timelines for compliance (main obligations start on 11 December 2027, with incident‑reporting rules from 11 September 2026). The guidance is available on the European Commission’s website.