In brief
- A connected machine sold in the European Union after 11 December 2027 must comply with the Cyber Resilience Act (Regulation (EU) 2024/2847) in the components and software libraries it contains as well, so the contracts signed today with suppliers and software houses must already ensure that what they deliver can be compliant.
- To assess a component supplier, it is not enough to know whether it has a vulnerability management process: what matters is how it has handled past vulnerabilities. According to Claudio Telmon of P4I, the greatest risk lies with small, loosely structured suppliers and with open source libraries.
- From 11 September 2026 the manufacturer must report to ENISA and the national CSIRT the exploited vulnerabilities and the incidents affecting the security of the product, including those originating in the supply chain, such as a backdoor inserted into the software by someone working for a supplier or stolen code signing keys.
Article contents
If one of your connected machines reaches the market after 11 December 2027, its compliance with the Cyber Resilience Act (CRA) also depends on choices you make now: the radio module, the electronic board, the firmware libraries and the software house that develops the app. In the webinar on CRA and NIS2 organized by Things5 with P4I – Partners4Innovation, Claudio Telmon, Senior Partner Information & Cyber Security at P4I, pointed out the moves to make right away: put compliance into today's contracts, assess suppliers on the history of the vulnerabilities they have handled and keep a bill of materials of the software components. From 11 September 2026 an obligation already in force is added, the duty to report incidents affecting the security of the product, even when they originate at a supplier.
Why the contracts signed today decide compliance in 2027
Contracts with suppliers already matter because the CRA requires the product placed on the market to be compliant, and a connected product is compliant only if the digital components it contains are too. The 11 December 2027 deadline refers to the moment each individual machine is sold, not the moment the model was designed: a line designed today, or already in stock, will have to be compliant if you sell it after that date.
Telmon explained it with those who are closing the agreements for a new product right now in mind.
If I now make an agreement with a component supplier, or with a software development company, to build a product that will reach the market in December 2027, I already have to address the issue contractually now and make sure that what is supplied to me can comply with this regulation.
Claudio Telmon, Senior Partner Information & Cyber Security, P4I – Partners4Innovation
For the product in the strict sense, time is not yet short, while strategic agreements and design must be set up right away, because that is where it is decided whether the machine will be able to meet the requirements. The same point came up at the end of the webinar: Daniele Delle Case, who moderated it for Things5, named the careful choice of suppliers and components from the design stage as the first priority.
What to ask a component supplier for the CRA
A component supplier should be asked whether it has a vulnerability management process, but above all how it has applied it so far. The CRA calls this check due diligence on the integration of third-party components, and places it on the manufacturer.
I can go to a manufacturer, ask whether it has a vulnerability management process, and it tells me yes, we have the process, but we have never had any vulnerabilities. After that, whether this process works we will find out when there is a vulnerability.
Claudio Telmon, Senior Partner Information & Cyber Security, P4I – Partners4Innovation
That is why Telmon suggests looking at the supplier's history, that is, how many vulnerabilities have emerged in its products and how it has handled them. Technical checks exist (vulnerability assessment is by now an established practice in product development), so you can ask the supplier whether it carries them out, whether it has done so on the component it sells you and with what results. The critical point, according to Telmon, is not the tools but the supplier's ability to understand what you are asking and to answer you.
| Type of supplier | What you can expect | What to do |
|---|---|---|
| Large automation manufacturer | Answers questions about the security of its components without difficulty (Telmon cites Siemens as an example) | Ask how it handles vulnerabilities and for the results of the checks on the component you buy |
| Small local manufacturer or loosely structured foreign supplier | May have no process, or may not understand the request | Assess whether it can deal with the issue before tying yourself to it with a contract |
| Open source library | It is often unclear whom to turn to and the guarantees are weaker | Put it in the bill of materials and be ready to step in yourself, which in this case is easier |
| Software house developing firmware or apps | Works on a product that will reach the market after 2027 | Write into the contract that the deliverable must be able to comply with the CRA |
When the supplier does not just sell you a component but accesses your machines remotely, for maintenance or with data flows to a cloud system, the contract also needs technical requirements on the connection and on its systems. What they are, and how they change between a technician connecting for a service call and a predictive maintenance system, Telmon explains in answer to a question from the audience in the recording of the webinar on CRA and NIS2 (in Italian).
How to check components already on the market before 2027
For components on sale today, which are not yet required to comply with the CRA, the only possible check is to ask the manufacturer for confirmation. After 11 December 2027 the check becomes simpler, because most connected components, physical or logical, will themselves have to be compliant and carry a CE marking you can verify.
In the meantime the choice remains yours, together with the risk. As Telmon points out, if a component turns out to be non-compliant, you still have to manage the security of the finished product. Machines already sold have no obligation to be brought into line with the design requirements, while those you sell after 2027 do, even if they belong to a line already in production. Deadlines and special cases are collected in the article on what the CRA requires from manufacturers (in Italian).
SBOM: why the software bill of materials concerns suppliers
The software bill of materials (SBOM) is the list of all the software components used in the product. The CRA requires it because in-house code is by now a small part of the firmware compared with third-party libraries and components. For each item on the list you must make sure there are no known vulnerabilities and that those discovered later are fixed with updates.
From this Telmon draws some practical consequences for those who design products.
- Choose the libraries you use carefully, assessing whether they will receive security updates.
- Make sure you can install updates on customers' machines, because a fix that does not reach the field does not close the vulnerability.
- Define the support period, that is, the time during which you commit to making updates available.
Installing updates on the installed base requires a channel to the machines, and it is one of the reasons why machine connectivity has become a compliance issue as well as a service one: Things5 Connect lets you distribute firmware updates remotely to one or many machines and see the outcome for each one. To find your way through the technical requirements, ENISA (the European Union Agency for Cybersecurity) has published a mapping between the CRA requirements and widely used standards such as ISO/IEC 27001 and IEC 62443, useful if your company already applies one of them.
Importers and rebranded products: the responsibility stays with you
If you import or rebrand a product made by others, the responsibility towards the European market is yours. A product rebranded with your name formally makes you the manufacturer. The importer, on the other hand, is responsible for the compliance of the product it places on the market, for the CE marking and for the manufacturer having drawn up the technical documentation.
In both cases you cannot fix the vulnerabilities yourself or guarantee the updates, so the only tool at your disposal is the contract with whoever supplies the product. As Telmon explained, the European Commission wants its counterpart to be whoever places the product on the European market, not the foreign supplier.
Supply chain incidents: what to report from 11 September 2026
From 11 September 2026 the manufacturer must report to ENISA and the national CSIRT actively exploited vulnerabilities and severe incidents that have an impact on the security of the product, with an early warning within 24 hours (Article 14 of Regulation (EU) 2024/2847). When the webinar took place it was a future deadline; today it is an obligation in force.
The incidents to report, Telmon clarified, are above all those that occur in development and production environments, and several of his examples concern the supply chain itself:
- unauthorized access to the development environment;
- a backdoor inserted into the software by a disgruntled employee of your supplier;
- stolen code signing keys, which can then be used to sign malware.
Reporting does not require you to suspend sales. Incidents like these often translate into product vulnerabilities, to be handled with the ordinary process by producing fixes and making them available. Stopping production to sort things out may be worthwhile, but it remains an operational choice. It follows that, to meet the reporting deadlines, you need to know quickly what is happening in your suppliers' development environments.
If your company is also a NIS2 entity
If your company falls within the scope of the NIS2 directive, the supply chain is also an organizational obligation. Margherita Masseroni, Senior Legal Consultant at P4I, recalled that Italian Legislative Decree 138/2024 requires companies to identify the risk associated with suppliers and to define the measures for selecting, assessing and monitoring them over time. For companies included in the list of NIS2 entities with the communications from ACN (the Italian National Cybersecurity Agency) in April 2025, the 18-month deadline for complying with these obligations arrived in October 2026. The exact date depends on the communication received, so check it on the website of the Agenzia per la Cybersicurezza Nazionale.
Where to start with suppliers
The first step is to list the suppliers that touch the digital part of the machines you will sell after 2027 (electronic components, radio modules, libraries, software houses, cloud services). For each one, check what the contract says about CRA compliance, how it has handled vulnerabilities so far and how it will notify you of an incident in its systems. It pays to do this before closing new agreements, while you still have room to ask for guarantees. If you are evaluating the electronics of a new machine, the introduction to IoT hardware helps you understand which components will come into play.
In the webinar recording Telmon also addresses a case that concerns many manufacturers, namely what happens when you add a radio module and an app to manage a machine remotely, and why at that point the app becomes part of the product. Margherita Masseroni explains who falls within NIS2, including the rules for small businesses that are part of a group.
Frequently asked questions
Does a component I buy today already have to comply with the CRA?
Does the Cyber Resilience Act also cover the open source libraries in the firmware?
If I rebrand or import a product from a foreign supplier, who is responsible under the CRA?
Does a security incident at a supplier force me to stop sales?
Is the mobile app that manages the machine covered by the Cyber Resilience Act?
Watch the recording of the webinar on CRA and NIS2
Claudio Telmon and Margherita Masseroni of P4I explain what CRA, NIS2 and RED require from machine manufacturers and answer questions from the audience (in Italian). Fill in the form and receive the link to the recording by email.
