What will EU manufacturers ask their software vendors under the Cyber Resilience Act?

Since September 11, 2026, a manufacturer selling a connected product in the EU has 24 hours to send an early warning when it learns that a vulnerability in that product is being actively exploited. If your company writes software for such manufacturers, they are likely to ask you how fast you can tell them, what is inside your code and how long you will support it. The companies that can answer clearly have a reason to start conversations now, about thirteen months before most of the regulation applies.

What changed on September 11, 2026?

The Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force on December 10, 2024, and its obligations apply in stages. The first one that touches daily operations started on September 11, 2026: manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products through the single reporting platform run by ENISA.

Two details matter for anyone who supplies software. First, the reporting duty also covers products placed on the market before that date, unlike most other CRA requirements. Second, the clock starts when the manufacturer becomes aware of the issue, so anything that slows down information from its suppliers eats into those 24 hours.

Who carries the obligation when your team writes the code?

Under the regulation, the manufacturer is the company that develops a product, or has it developed, and markets it under its own name or trademark. If you build firmware, an app or a control system that a client sells under its brand, the client is usually the manufacturer and carries the obligations. Your code does not leave the picture, though. It becomes part of a product someone else must report on, document and support.

Some cases are less clear. Standalone software-as-a-service is generally outside the CRA, while remote data processing that a product needs to perform its functions is treated as part of that product. Bespoke software built for a single client is a judgment call that the text does not settle explicitly. This is where a lawyer should look at your contracts, not a blog post.

What will manufacturers ask their software vendors?

The regulation says that manufacturers must exercise due diligence when integrating components sourced from third parties, so that those components do not compromise the product's cybersecurity. It also requires them to identify and document the components in a product, including through a software bill of materials. The questions below are my reading of what follows from those duties. They are a hypothesis, not a checklist from the regulator.

None of this requires a certification today. Most substantive requirements, including technical documentation, conformity assessment and CE marking, apply from December 11, 2027. But a manufacturer that has started its reporting process this fall is likely reviewing suppliers now, not in a year.

Why is this a sales question and not only a compliance one?

My working assumption is that a regulation changes buying behavior well before anyone is fined. A procurement team that must answer new questions will prefer suppliers who already have the answers, and it may quietly stop inviting the ones who do not.

For a software company that sells to manufacturers in the EU, that creates two openings. Existing clients need help answering for code you wrote, which is a reason for an account conversation rather than a support ticket. And manufacturers of connected products, industrial equipment or devices who work with vendors that cannot answer are a list of companies with a reason to listen to you this quarter.

This is how we think about outbound at MSGA. We start with what our client can prove and who on the other side of the market needs exactly that right now. A regulation with a fixed date is a clear version of "right now", and it is visible to everyone who reads the text, so the advantage goes to the vendor who can show evidence, not the one who mentions the deadline first.

What should a software company do this quarter?

Start with your own house. Check whether you can produce a software bill of materials for a recent delivery, who would notify a client about an exploited vulnerability and how fast, and what support period you could commit to. If those answers take a week to assemble, assume your clients will notice.

Then write the answers down in a form a buyer can use: one page, plain language, with the commitments you are willing to put in a contract. That page is useful in renewals, in vendor reviews and in first conversations with manufacturers who are only now realizing what the 24-hour clock means for their supply chain.