If you sell in the Union a product that connects to anything — a device, an application, a software component — its security is no longer a commercial choice but a condition of placing it on the market. The Cyber Resilience Act treats it like any other product conformity requirement.
We work with manufacturers, importers and distributors, both on documentation and marking and on the supply chain contracts, where liability shifts easily from one party to another.
Situations in which we are called
- You are placing a product with digital elements on the market and do not know its class
- You import or distribute such products and want to know what you answer for
- The technical documentation and declaration of conformity have to be prepared
- You have learned of an exploited vulnerability and the reporting clock is running
- A client asks for contractual assurances about product security
- You use open source components and the duties need clarifying
What we cover
- Classifying the product and determining the applicable assessment procedure
- Technical documentation, declaration of conformity and CE marking
- Vulnerability handling policy and the support period
- Procedures for reporting exploited vulnerabilities and incidents
- Supply chain clauses and clauses on third-party components
- Product liability, as it relates to security
How we work
We start with classification, because everything else depends on it: what documentation you need, whether a notified body is required, and how long it takes. A wrong classification is paid for late, when the product is ready to launch.
We also discuss the support period early, because it is a duty with a direct economic effect: you promise security updates for a period, and that period enters the product’s cost calculation, not just its documentation.
What helps us start
- A description of the product and its components, including third-party ones
- Existing technical documentation and any security assessments carried out
- The contracts with component suppliers
- The markets you sell into and your role in the chain
