Exclusions And Transitional Scope Under The EU Cyber Resilience Act

EU Cyber Resilience Act

The Cyber Resilience Act, Regulation (EU) 2024/2847, introduces for the first time a horizontal framework of cybersecurity obligations for products with digital elements. It extends the familiar architecture of Union product law, with CE marking, conformity assessment and market surveillance, into the digital domain. What makes it different is the direct application to software, the imposition of vulnerability handling duties, and the recognition that certain categories of products are more consequential for the Union's resilience than others.

The Regulation draws distinctions between important and critical products. Important products are subdivided into two classes. Class I includes operating systems, browsers, routers, password managers and similar items. These may be conformity assessed by the manufacturer itself where harmonised standards or recognised certification schemes exist. Class II covers firewalls, intrusion prevention