INDUSTRIES, TECHNOLOGY | The EU Commission publishes draft guidance on the Cyber Resilience Act

On 3 March 2026, the EU Commission published the first draft of guidance (Guidelines) to assist companies in the effective application of the Regulation (EU) 2024/2847 (Cyber Resilience Act), whose reporting obligations will be applicable from 11 September 2026.

The CRA establishes cybersecurity requirements for products with digital elements placed on the EU market, including both hardware and software, as well as related remote data processing solutions. These requirements apply not only to the products themselves, but also to their design, development and maintenance throughout their lifecycle.

Pursuant to Article 26 of Cyber Resilience Act, the EU Commission is required to issue guidance to assist economic operators, in particular microenterprises and SMEs, in complying with the Regulation. The Guidelines provide clarifications on several key aspects of the Cyber Resilience Act, including its scope of application, (including with respect to open-source software), the notion of “support period”, the concept of “substantial modification” and the interaction between the Cyber Resilience Act and other EU legislation. The Guidelines also address practical implementation issues, such as the classification of products (including the distinction between important and critical products), cybersecurity risk assessment and management, remote data processing and reporting and incident notification obligations.

The draft Guidelines are open for public consultation until 31 March 2026 and further revisions are expected before their final adoption.

Newsletter n. 116 – March 2026