A smart door lock, payment terminal, industrial sensor or business app can now create a compliance obligation that follows your company for years. The EU Cyber Resilience Act affects Malta businesses that manufacture, import or distribute connected products, with reporting duties starting in 2026 and most requirements applying from 11 December 2027.
The Act is not limited to large technology companies. If your business sells a product with software, internet connectivity, Bluetooth, cloud features or a digital control system in the EU, it may be in scope.
#What is the EU Cyber Resilience Act?
The EU Cyber Resilience Act, or CRA, is Regulation 2024/2847. It sets cybersecurity requirements for products with digital elements across their entire lifecycle, from design and development through support, updates and eventual end of life.
The regulation entered into force on 10 December 2024. The European Commission says the main obligations apply from 11 December 2027, while reporting obligations for actively exploited vulnerabilities and serious incidents apply from 11 September 2026.
Products potentially covered include:
- Smart home and office devices
- Routers, cameras, access-control systems and printers
- Industrial equipment with software or network connectivity
- Mobile and desktop applications
- Internet-connected medical, retail or hospitality equipment
- Software supplied with hardware
- Cloud or remote data-processing services linked to a product
The test is not whether the product looks like a computer. The test is whether it has a direct or indirect logical or physical connection to a device or network.
#Who has duties under the CRA?
The biggest obligations fall on manufacturers. A manufacturer can be a Malta company designing and producing its own device, or a business placing a product under its own brand even if another company builds it.
Manufacturers must build security into the product, identify and manage vulnerabilities, provide security updates, maintain technical documentation and complete the appropriate conformity assessment before placing the product on the EU market.
Importers and distributors have different responsibilities, but they are not passive middlemen. A Malta importer bringing connected equipment from outside the EU must check that the manufacturer has completed the required documentation, supplied conformity information and applied the CE marking where required.
Distributors must check product markings, user instructions and relevant documentation before making products available. If they discover that a product does not comply, they may need to stop supplying it and notify the appropriate authorities.
| Your role | Main responsibility | Practical Malta example |
|---|---|---|
| Manufacturer | Secure design, vulnerability handling, documentation and conformity assessment | A Malta firm selling its own smart energy-monitoring device |
| Importer | Verify the non-EU manufacturer’s compliance before placing products on the EU market | Importing connected CCTV systems from Asia |
| Distributor | Check markings, instructions and documentation before sale | Supplying networked point-of-sale equipment to hotels |
| Software provider | Manage security across the supported product lifecycle | Selling an application linked to a connected device |
#What changes for product security?
The CRA moves cybersecurity from an internal IT concern into a product responsibility. A secure office network does not make an insecure product compliant.
Manufacturers need a repeatable process that covers:
- Security risk assessment during product design
- Secure default settings
- Protection against unauthorised access
- Encryption where appropriate
- Vulnerability disclosure and response
- Software bill of materials and dependency tracking
- Security updates throughout the support period
- Clear user instructions and security configuration guidance
The support period must reflect how long customers reasonably expect the product to remain in use, with a minimum period generally linked to five years or the expected product lifetime, whichever is longer. That means a company cannot simply sell a device and abandon it after the warranty expires.
The commercial risk is not only a fine: a vulnerability that cannot be patched can force a recall, damage customer trust and make future EU sales impossible until the product is corrected.
#What are the CRA reporting deadlines?
From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting products with digital elements through the EU’s single reporting platform.
The initial early-warning report for an actively exploited vulnerability is due within 24 hours of the manufacturer becoming aware of it. Further information and a final report follow within the required deadlines. The European Commission has also stated that a final report must be submitted no later than 14 days after a corrective or mitigating measure becomes available for an actively exploited vulnerability, and within one month for a severe incident.
This creates an operational requirement, not just a legal one. A business needs to know who monitors vulnerability reports, who decides whether an incident is reportable, who communicates with customers and who approves emergency patches.
Malta companies should also consider how these duties interact with existing GDPR breach procedures, contractual commitments and any obligations under Malta’s cybersecurity or sector-specific rules. The CRA does not replace those requirements.
#How should a Malta business prepare?
Do not wait for the December 2027 deadline. Product documentation, supplier contracts and update processes take time to fix.
- Map every product in scope. List hardware, software, firmware, mobile apps, cloud components and remote-management services sold to EU customers.
- Confirm your legal role. Decide whether your business is acting as manufacturer, importer, distributor or more than one of these.
- Ask suppliers for evidence. Request conformity information, vulnerability-management procedures, support periods, security-update commitments and incident-notification contacts.
- Create a vulnerability process. Define how reports are received, assessed, prioritised, patched and escalated.
- Build an asset and dependency inventory. Track third-party libraries, firmware versions, cloud services and products that need updates.
- Review contracts. Add clear duties for security fixes, response times, disclosure, product recalls and cooperation with regulators.
- Check conformity requirements. Some products may be able to use self-assessment; higher-risk product categories may require an assessment by a notified body.
- Test incident reporting. Run a tabletop exercise before September 2026 so staff know what happens during an actively exploited vulnerability.
- Set a support end date. Tell customers how long security updates will be provided and make the process visible at the point of sale.
- Get technical help early. A managed IT provider can help organise vulnerability monitoring, patch management, logging and evidence collection, but product compliance remains the manufacturer’s responsibility.
The EU Cyber Resilience Act is best treated as a product-development and supply-chain project, not a document to complete at the last minute. Malta businesses that sell connected products should identify their exposure now, establish ownership and start collecting evidence before customers, suppliers or regulators ask for it.
If you want to stop worrying about connected product cybersecurity and compliance, get in touch — we work with Malta businesses to make IT one less thing on your list.
