Cyber Resilience Act: The 5 Most Important Questions for Procuring IoT Hardware

Many companies are preparing for the Cyber Resilience Act (CRA) with a target date of December 2027. However, the first actual deadline is much earlier: Starting September 11, 2026, manufacturers must report actively exploited vulnerabilities to ENISA and the relevant CSRIT within 24 hours. The law will take full effect on December 11, 2027.

For anyone who procures routers, gateways, telematics platforms, modules, or wireless sensors and integrates them into their own applications, this means a transition that requires advance planning, but without much leeway. We’re currently hearing the following five questions particularly often:

Question 2: What are the deadlines, and what happens to existing inventory?

Here, too, the two deadlines apply: September 11, 2026, for reporting vulnerabilities and security incidents, and December 11, 2027, for full compliance. As of that date, only products that meet all CRA requirements may be placed on the market.
Grandfathering applies to individual product units, not to models or series. If a manufacturer ships a sensor on December 10, 2027, the grandfathering provision applies. The same product series shipped the following day must be fully compliant. For procurement, this means planning orders and delivery times so that new units and replacement parts shipped after the deadline reliably come from compliant production.

Question 3: How long are security updates provided, and who reports vulnerabilities?

The CRA requires manufacturers to provide security updates throughout the expected service life, which means for at least five years. For IoT applications with lifespans of eight to fifteen years, this is a tight timeframe. So be sure to ask specific questions for each product category.

Second point: the process for coordinated vulnerability disclosure (CVD). Every manufacturer needs a documented, publicly accessible reporting channel. If someone reports a vulnerability, you should be notified without having to follow up yourself.

An increasingly important tool in this context is the Software Bill of Materials (SBOM), a machine-readable inventory of all software components in a product, typically in SPDX or CycloneDX format. The CRA requires manufacturers, in Annex I, Part II, to create an SBOM, at least at the top-level dependencies level. If a vulnerability in a widely used library becomes known at a later date (e.g., Log4Shell), you can use the SBOM to check for yourself which of your devices are affected without having to wait for feedback from each manufacturer. There is no obligation to publish SBOMs; they are provided upon request and retained for ten years.

Question 4: What CRA documents does m2m Germany provide?

For your own compliance documentation, for audits, and for your end customers, you need the following key documents for each product:

• EU Declaration of Conformity,
• technical documentation (product description, risk analysis, safety measures, SBOM) and
• User manual with guidelines for secure configuration.

The goal is to make the available documentation available in a consolidated format and assigned to the respective products as soon as it is provided by the manufacturers. This would create a central source of information, eliminating the need for you to search individual manufacturer portals.
In addition, an overview could be provided showing which documents are already available for each item. Any missing documentation would be added accordingly, as soon as it becomes available.

In addition, it must be clarified where the manufacturer’s responsibility ends and yours, as an integrator, begins: The manufacturer documents the product, while you document the specific installation scenario, network segmentation, and configuration of your end application. This helps avoid disputes during a later audit.

Question 5: Who is liable in the supply chain, and how exactly does m2m Germany provide support?

The CRA allocates responsibilities differently among manufacturers, importers, distributors, and operators. The key point for many of our customers is this: Anyone who integrates a component into a final product and sells it under their own name becomes a “manufacturer” under the CRA, with all the associated obligations regarding conformity assessment, documentation, and reporting.

A typical example: a programmable Linux telematics platform on which you can develop your own (fleet management) application and deliver it under your own brand. The platform manufacturer is the CRA manufacturer for the base system; you become the CRA manufacturer for the end product.

Specifically, we see our role as follows: For routers, gateways, telematics platforms, and wireless sensors, we are a value-added distributor; that is, as soon as the required documentation is available from the manufacturers, we will make it available as well.

When it comes to modules, our network of manufacturers allows us to go a step further and actively support you in working with the right supplier to achieve CRA compliance—from selecting suitable components to consolidating requirements for the manufacturer.

Disclaimer:

This guide is not a substitute for legal advice. For your specific situation, we recommend consulting qualified legal professionals or a conformity assessment body.