EU Technology Requirements for U.S. Product Companies
A map of the EU laws that now set engineering requirements for U.S. connected products, with the dates that matter and the guide to read for each question.
If you design connected products in the United States and sell them in the EU, several EU laws now set engineering requirements: how the product is secured, how long you fix its vulnerabilities, how fast you report exploited ones, and whether users can get at the data it generates. This hub explains those laws for engineering leaders and points you to the guides where the work actually happens.
Who this applies to
- Manufacturers of products with digital elements sold on the EU market. The EU Cyber Resilience Act covers hardware and software products with a data connection, including their remote data processing [1]. It applies to non-EU manufacturers whose products are made available in the EU [1].
- Manufacturers of connected products and providers of related services under the EU Data Act, irrespective of where they’re established [2].
- Machinery makers, whose products fall under the Machinery Regulation, which includes requirements on protection against corruption of safety-relevant software and data [3].
- Radio equipment makers, where the Radio Equipment Directive’s cybersecurity delegated act applies until the CRA takes over [4][5].
Some sectors with their own EU product rules, such as medical devices and motor vehicles, are excluded from the CRA [1]. The Cyber Resilience Act guide walks through the scope test.
Key dates
Re-verified on EUR-Lex and Commission pages on 2026-11-10.
| Date | What happens | Source |
|---|---|---|
| 10 December 2024 | Cyber Resilience Act entered into force | Art. 71(1) [1][6] |
| 11 June 2026 | Cyber Resilience Act rules on notifying conformity assessment bodies (Chapter IV) apply | Art. 71(2) [1] |
| 11 September 2026 | Cyber Resilience Act reporting obligations (Art. 14) apply | Art. 71(2) [1] |
| 12 September 2026 | Data Act "access by design" duty applies to connected products placed on the market after this date | Data Act Art. 50 [2] |
| 20 January 2027 | Machinery Regulation (EU) 2023/1230 applies | EUR-Lex document information [7] |
| 11 December 2027 | Cyber Resilience Act main obligations apply; RED cybersecurity delegated act repealed from this date | Cyber Resilience Act Art. 71(2) [1]; [5] |
The Digital Omnibus (COM(2025) 837) is a Commission proposal, not law. Our EU regulatory timeline tracks its status and every date above, with sources.
Decision map
Start from the question you’re being asked:
- "Does the CRA apply to our product, and what class is it?" → the Cyber Resilience Act guide, then Cyber Resilience Act product classes.
- "We had an exploited vulnerability. What do we report, and when?" → the Cyber Resilience Act reporting obligations now apply, then our PSIRT guide.
- "How long must we ship security updates?" → Cyber Resilience Act support period, and our secure firmware update architecture guide.
- "Customers are asking for their equipment data." → the EU Data Act guide.
- "Our machine has safety software. Does the new Machinery Regulation change anything?" → Machinery Regulation cybersecurity, and Cyber Resilience Act vs. other EU rules.
- "Which standard proves conformity?" → our product security standards hub.
Interpretation is only step one. The engineering follows in our embedded and firmware security, product security operations and engineering partner hubs.
Start here
- Read the Cyber Resilience Act guide.
- If you sell connected equipment, read the EU Data Act guide.
- Check your reporting readiness now. It already applies [1].
Guides in this section
- The EU Cyber Resilience Act: a practical guide for U.S. manufacturers: scope, dates, product classes and the engineering workstreams.
- EU Data Act: what U.S. connected-product makers need to know: connected products, the design duty, data requests and trade secrets.
- Product security standards (sub-hub): IEC 62443, EN 18031, ETSI EN 303 645.
Sources
All accessed 2026-11-10.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024. Cited: Art. 2, 3(1), 14, 71. EUR-Lex, ELI: http://data.europa.eu/eli/reg/2024/2847/oj
- Regulation (EU) 2023/2854 (Data Act), OJ L, 2023/2854, 22.12.2023. Cited: Art. 1(3), 3(1), 50. EUR-Lex, ELI: http://data.europa.eu/eli/reg/2023/2854/oj
- Regulation (EU) 2023/1230 on machinery, Art. 1; Annex III section 1.1.9. EUR-Lex, ELI: http://data.europa.eu/eli/reg/2023/1230/oj
- EUR-Lex, document information for Commission Delegated Regulation (EU) 2022/30 (application 01/08/2025; amended by 2023/2444; repealed by 2026/339 with effect from 11/12/2027). https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32022R0030
- European Commission, "Radio Equipment Directive (RED)" page (2026/339 published in the OJ on 29 April 2026; repeal effective 11 December 2027). https://single-market-economy.ec.europa.eu/sectors/electrical-and-electronic-engineering-industries-eei/radio-equipment-directive-red_en
- EUR-Lex, document information for Regulation (EU) 2024/2847 (dates of effect). https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32024R2847
- EUR-Lex, document information for Regulation (EU) 2023/1230 (application 20/01/2027). https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32023R1230
Spotted an error? Report it to our corrections log. Read our editorial methodology.