The EU Cyber Resilience Act (EU) 2024\/2847 (“Cyber Resilience Act<\/strong>\u201d \/ \u201cCRA<\/strong>\u201d) was adopted in 2024, and, as a regulation, it is directly applicable in all EU Member States in stages, with the final provisions coming into force in the summer of 2028. In Finland, the CRA has been supplemented primarily by the national Cyber Resilience Act (439\/2026), which came into force in June 2026. As part of the legislative reform, the national Cyber Security Act (124\/2025) and the national Act on Electronic Communications Services (917\/2014), amongst others, were also updated to reflect the cyber resilience era. The national legislation supplementing the CRA primarily designates the competent authorities and organises the official duties laid down in the CRA at national level. In Finland, the duties of the competent authority are assigned to Traficom and the National Cyber Security Centre under its remit.<\/p>\n The scope of the CRA is very broad. It covers all equipment and software \u2013 including their separate components \u2013 that contain digital elements \u2013 in other words, operate in a digital environment \u2013 and can be connected, directly or indirectly, to a network or to a piece of equipment. In the CRA, connections<\/em> are defined as logical connections<\/em> (software interfaces) and physical connections<\/em> (electrical, optical and mechanical interfaces, cables, wires and radio waves). An indirect connection<\/em> refers to a situation where a product or component does not have a direct connection, as described above, to a device or network, but is part of a wider system that can be connected to a device or network via such a connection.<\/p>\n However, the following are excluded from the scope of the CRA: marine equipment subject to specific product safety regulations, aviation equipment, motor vehicles, their trailers and components, technical units for road transport, medical devices, and products relevant to national security. The CRA imposes obligations on operators of all sizes, ranging from product manufacturers and authorised representatives to importers and distributors. The Cyber Resilience Act also contains limited obligations applicable to open-source software stewards. However, in line with the EU\u2019s regulatory trend, the obligations applicable to micro-enterprises and SMEs have been partially relaxed.<\/p>\n *On 27 July 2026, the Commission published detailed implementing guidelines which provide further clarification, in particular, on the interpretation of the concepts defined in the CRA (2026, 5252 final).<\/em><\/p>\n The Cyber Resilience Act is a horizontal product safety regulation, meaning that its application is not limited to specific sectors. The regulation forms part of the EU\u2019s CE marking framework. The CE marking certifies that a product complies with the applicable product requirements, including the cybersecurity requirements set out in the CRA. Consequently, compliance with the requirements of the Cyber Resilience Act will, in future, be a prerequisite for products falling within its scope to be placed on the EU market.<\/p>\n The cybersecurity requirements for products set out in the CRA will apply to products placed on the EU market on or after 11 December 2027. Furthermore, the cybersecurity requirements for products will also apply to products that are subject to a\u00a0substantial modification on or after 11 December 2027. However, where a product is covered by any other type-examination certificate or approval decision relating to cybersecurity based on EU legislation, such certificates and decisions may remain valid until 11 June 2028 at the latest.<\/p>\n Manufacturers\u2019 reporting obligations regarding vulnerabilities and incidents apply to all products falling within the scope of the CRA, regardless of when the product was first placed on the EU market. These reporting obligations came into force on 11 September 2026.<\/p>\n The first step towards complying with the CRA\u2019s product requirements is a cybersecurity risk assessment, which the manufacturer is responsible for carrying out. The aim of the risk assessment is to ensure that the product has been designed, developed and manufactured in accordance with the cybersecurity requirements set out in the CRA. The CRA is based on a risk-based approach. The higher the risk associated with a product, the greater the requirements for its cybersecurity. Based on the risk assessment, the manufacturer must draw up a plan setting out the necessary risk management measures.<\/p>\n The assessment of cybersecurity risks can be divided into three distinct areas: (i) risk analysis based on intended use and operating conditions, (ii) compliance with cybersecurity requirements, and (iii) compliance with requirements concerning the handling of vulnerabilities. The risk assessment must be documented and included in the product\u2019s technical documentation. Furthermore, it must be kept up to date throughout the product\u2019s support period (i.e. the time the products are expected to be in use).<\/p>\n The manufacturer \u2013 or an authorised representative acting on the manufacturer\u2019s behalf \u2013 must carry out a conformity assessment for products falling within the scope of the Cyber Resilience Act. Class I and II important products and critical products as defined in the Cyber Resilience Act are subject to more stringent third-party assessment procedures \u2013 that is, those carried out by an assessment body or a notified body \u2013 whilst the conformity assessment of other products \u2013 including open-source essential products \u2013 may be carried out independently. Following the conformity assessment, the manufacturer \u2013 or an authorised representative acting on the manufacturer\u2019s behalf \u2013 draws up an EU Declaration of Conformity for the product and affixes the CE marking to it.<\/p>\n Manufacturer<\/em><\/p>\n Before placing the product on the market, the manufacturer must also ensure that technical documentation meeting the CRA\u2019s requirements, as well as instructions and other information to be provided to users, has been drawn up for the product. Once the product has been placed on the market, the manufacturer is responsible for the effective handling of vulnerabilities throughout the support period. The manufacturer must also keep the technical documentation and security updates available for the duration of the support period, but for at least 10 years. The manufacturer also has extensive obligations to cooperate with the authorities, as well as an obligation to report vulnerabilities to component manufacturers within the supply chain and to open-source software stewards.<\/p>\n Authorised Representative<\/em><\/p>\n The authorised representative is obliged to carry out the tasks assigned to them by the manufacturer. The authorised representative may be assigned, in particular, the conformity assessment procedure (responsibility remains with the manufacturer), the inclusion of the necessary information with the product, the retention of technical documentation, and cooperation with the competent authority. The authorised representative must always keep the EU Declaration of Conformity and the technical documentation available to the market surveillance authority for the duration of the support period \u2013 but for at least 10 years \u2013 and must cooperate with the authority where necessary.<\/p>\n Importer and distributor<\/em><\/p>\n The importer must ensure that the conformity assessment procedure has been carried out, that the technical documentation for the product has been drawn up, that the product bears the CE marking, and that it is accompanied by the EU Declaration of Conformity as well as the information and instructions to be provided to the user. Once this has been verified, the importer must provide their own contact details in connection with the product. The importer has extensive obligations to cooperate with the competent authority, as well as an obligation to keep the EU Declaration of Conformity and technical documentation available to the competent authority for the duration of the product\u2019s support period, but for at least 10 years. The importer is also obliged to report vulnerabilities and significant cybersecurity risks to the manufacturer, including significant cybersecurity risks and the cessation of the manufacturer\u2019s operations, to the market surveillance authority.<\/p>\n The distributor\u2019s obligations largely correspond to those of the importer. However, unlike the importer, the distributor is not required to ensure that technical documentation has been drawn up for the product \u2013 including other details concerning the conformity assessment procedure. Nor is the distributor responsible for ensuring that the technical documentation is made available to the authorities. In this regard, however, the distributor must ensure that the importer\u2019s details are marked on the product.<\/p>\n The Cyber Resilience Act requires manufacturers to report serious incidents affecting the information security of products and actively exploited vulnerabilities to the competent authorities; in Finland, this is the CSIRT unit operating under Traficom\u2019s National Cyber Security Centre (Computer Security Incident Response Team). As a general rule, reporting follows a three-stage process. First, an early warning notification must be issued without delay and no later than 24 hours after the incident or vulnerability is detected. Within 72 hours, the manufacturer must provide a more detailed incident notification on the vulnerability or incident. The manufacturer must issue a final report on vulnerabilities within 14 days of a corrective or mitigating measure becoming available, and on incidents within one month of the incident report. The CSIRT may also, where necessary, request an interim report on a vulnerability or incident.<\/p>\n In certain cases, the CSIRT may disclose information about an incident or require the manufacturer to do so. With regard to vulnerabilities, the disclosure of information is the general rule, from which exceptions may be made only in limited cases.<\/p>\n In line with EU cybersecurity regulatory trends, the CRA has also adopted a voluntary reporting practice. Anyone can report product-related vulnerabilities, cyber threats, incidents and near-misses to the CSIRT unit. Where necessary, the CSIRT unit will notify the product manufacturer of the matter.<\/p>\n In accordance with established practice in product regulation, the manufacturer\u2019s obligations are transferred to the importer or distributor to the extent that the latter places the product on the market under their own name or trademark, or makes a substantial modification to a product already placed on the market.\u00a0 In limited cases, the manufacturer\u2019s obligations may also be transferred to a party other than the importer or distributor, provided that such party makes a substantial modification to the product and makes it available on the market. However, the manufacturer\u2019s liability may be transferred to a party other than a distributor or importer only in respect of the effects of such modifications.<\/p>\n All economic operators under the CRA \u2013 that is, the manufacturer, authorised representative, importer and distributor \u2013 must keep records of the product\u2019s supply chain. Upon request, economic operators must provide the market surveillance authority with the name and address of every economic operator to whom they have supplied, or from whom they have received, a product containing digital elements during the last 10 years.<\/p>\n The Cyber Resilience Act provides for three administrative fines of varying amounts:<\/p>\n With regard to administrative fines, the standard public sector exemption applicable in Finland applies, under which no administrative fine may be imposed on a public sector entity. Furthermore, no administrative fine may be imposed on open-source software stewards as defined by the CRA. In such cases, however, it is possible to impose a penalty payment.<\/p>\n With the new national Cyber Resilience Act, Finland has also implemented an administrative penalty relating to cybersecurity certification in accordance with the EU Cybersecurity Regulation (EU) 2019\/881. On this basis, a manufacturer whose product has been certified under a European cybersecurity certification scheme or who has issued an EU declaration of conformity may be subject to an administrative fine of up to EUR 100,000 for certain negligence, providing incorrect information and using a certificate that is not valid.<\/p>\n As part of product safety regulation, the Act on the Market Surveillance of Certain Products (1137\/2016) will also be applied to products that contravene the Cyber Resilience Act. Under the Act, the market surveillance authority may order an economic operator in the supply chain of a product that does not comply with the requirements of the Cyber Resilience Act to take corrective measures. The market surveillance authority may also, under the conditions laid down in the Act, among other things, prohibit the manufacturing, placing on the market and exporting of a product, and order the economic operator to recall the product from the market and destroy it. To ensure compliance with a prohibition or order, the market surveillance authority may impose a penalty payment or a performance order, in which case the necessary measures shall be carried out at the expense of the operator who has failed to act.<\/p>\nKey elements of the Cyber Resilience Act<\/h2>\n
Cybersecurity risk assessment<\/h3>\n
Conformity assessment<\/h3>\n
Placing the product on the market and post-market obligations<\/h3>\n
Reporting and notification obligations<\/h3>\n
Transfer of liability and monitoring of supply chains<\/h2>\n
Penalties for infringements<\/h2>\n
\n
<\/h3>\n
Read also:<\/h3>\n