# EU digital and mechanical product regulations > Live situation record from CLSTR: https://clstr.news/situations/eu-digital-and-mechanical-product-regulations > Updated: 2026-09-07T11:14:52.000Z. Sources: 14. Developments: 4. The European Union is implementing new regulatory frameworks to enhance the safety and security of digital and mechanical products. The EU Machine Regulation (EU) 2023/1230, set to become mandatory on January 20, 2027, establishes safety requirements for machines and their components. This regulation introduces complex requirements for risk assessment and cybersecurity, notably through the concept of “essential change,” which can shift manufacturer responsibilities to operators if hardware or software is altered. Complementing these measures, the Cyber Resilience Act (CRA), officially Regulation (EU) 2024/2847, mandates cybersecurity requirements for products with digital elements. Having entered into force on December 10, 2024, the CRA requires a ‘Security by Design’ approach, ensuring cybersecurity is integrated from the initial stages of development. The regulation covers hardware and software with network connectivity, regardless of whether they connect via the public internet. Obligations span the entire product lifecycle, including secure development, providing security updates, maintaining technical documentation, and managing a Software Bill of Materials (SBOM). While the NIS-2 directive focuses on organizational operations in critical sectors, the CRA specifically regulates the digital products themselves. Key milestones include the start of reporting requirements for actively exploited vulnerabilities and serious security incidents on September 11, 2026. Under the CRA, companies must adhere to strict reporting timelines, including early warnings within 24 hours and full reports within 72 hours. Full applicability, including CE marking requirements, is expected by December 11, 2027. To support compliance, Germany’s BSI has released technical guideline TR-03183, which provides practical guidance on IT security processes and SBOM formats like SPDX and CycloneDX, intended to be gradually replaced by harmonized European standards. The implementation of the CRA is shifting corporate security toward continuous vulnerability management, as AI-driven security tools increase the number of identified vulnerabilities, placing higher administrative burdens on IT departments to manage digital supply chains. ## Timeline ### 2026-09-07: EU regulatory updates drive new compliance and cybersecurity requirements Brain-Media.de updated its BAM Core model to track EU regulatory changes, while the Cyber Resilience Act mandates stricter, faster vulnerability reporting for companies. 4 sources. https://clstr.news/cluster/eu-regulatory-updates-drive-new-compliance-and-cybersecurity-requirements ### 2026-08-25: European Union implements Cyber Resilience Act for digital products The EU's Cyber Resilience Act mandates ‘Security by Design’ for connected hardware and software, requiring manufacturers to provide security updates and report incidents throughout a product's lifecycle. 9 sources. https://clstr.news/cluster/european-union-implements-cyber-resilience-act-for-digital-products ### 2026-08-13: EU Cyber Resilience Act introduces new digital product security mandates The EU Cyber Resilience Act mandates new security requirements for digital products by 2027. Germany's BSI has released a practical guide to help manufacturers manage compliance and vulnerability reporting. 3 sources. https://clstr.news/cluster/eu-cyber-resilience-act-introduces-new-digital-product-security-mandates ### 2026-07-21: EU Machine Regulation 2027 Raises Cybersecurity and Risk Assessment Demands for Manufacturers The EU Machine Regulation 2023/1230, effective 2027, imposes new cybersecurity, risk‑assessment and conformity‑assessment rules on manufacturers, with draft standards and guidance now available. 2 sources. https://clstr.news/cluster/eu-machine-regulation-2027-raises-cybersecurity-and-risk-assessment-demands-for-manufacturers --- Cite as: EU digital and mechanical product regulations. CLSTR, https://clstr.news/situations/eu-digital-and-mechanical-product-regulations