EU and Finnish cyber resilience rules
EU and Finnish cyber resilience rules: new obligations ahead
The EU Cyber Resilience Regulation and the Finnish Cyber Resilience Act impose new obligations on manufacturers, importers, exporters to the EU, and distributors of digital products.
The EU Cyber Resilience Act (CRA, EU 2024/2847) establishes product-level cybersecurity requirements for products that contain digital elements. The national Cyber Resilience Act (Act on the Cyber Resilience of Certain Products and Cybersecurity Certification, 439/2026), which entered into force on 1 June 2026, complements the EU act.
The EU Cyber Resilience Regulation has already introduced new obligations in June 2026 and will introduce further obligations in 2027 for manufacturers, importers, exporters to the EU, and distributors of digital products. The implementation of the EU regulation is proceeding in phases, and the key product safety requirements will become applicable in Finland in December 2027.
CRA’s goal is safer digital products
The European Union’s Cyber Resilience Regulation represents a significant change in the regulation and improvement of cybersecurity for digital products. Its goal is to improve the cybersecurity of devices and software sold on the EU market and to reduce product vulnerabilities throughout their entire lifecycle, regardless of where they were manufactured.
In practice, the regulation applies to virtually all products containing digital components. These may include, for example, smart devices, network equipment, smartwatches, computer software, and various consumer and business products that connect to the internet. However, the scope of application is determined based on the product’s characteristics and the exceptions outlined in the regulation.
Cybersecurity requirements must be taken into account as early as the product’s design and development phases. The manufacturer must conduct a cybersecurity risk assessment and consider the potential use of third-party components, ensuring that they do not compromise the product’s cybersecurity.
National Regulation — the Cyber Resilience Act entered into force in Finland in June 2026
The CRA Regulation entered into force in the EU on 10 December 2024. The entry into force of the Regulation does not mean that all of its obligations began on the same day or at the same time, nor does it mean that it contains all relevant provisions.
The national Cyber Resilience Act supplements the EU Regulation, particularly with regard to supervision, compliance, the designation of assessment bodies, and administrative sanctions. In Finland, the actual cybersecurity requirements for products continue to be based directly on the EU Regulation.
In Finland, the key supervisory authority is the Finnish Transport and Communications Agency (Traficom), whose Cybersecurity Center plays a central role in market surveillance and the receipt of notifications in accordance with the CRA.
Mandatory vulnerability reporting starting in September 2026
The CRA’s first significant practical obligation for companies is to report vulnerabilities detected in products. As of 11 September 2026, manufacturers are required to report actively exploited vulnerabilities as well as severe information security incidents that affect product security. In Finland, reports are directed to the Cybersecurity Center of Traficom, the national cybersecurity authority.
There are several deadlines associated with CRA-compliant reports. The manufacturer must submit an initial report within 24 hours of becoming aware of an actively exploited vulnerability or severe incident. A more detailed report must be submitted within 72 hours. Within 14 days, a final report must be prepared that includes a description of the vulnerability and its severity, any information regarding who may have exploited or may exploit the vulnerability, and a statement on how the issue has been resolved.
The manufacturer must also promptly notify affected users, and, if necessary, all users of the product of any detected vulnerability or severe incident. The manufacturer must also, if necessary, provide information on measures users can take to mitigate the risks associated with the vulnerability or incident.
Key CRA Requirements take effect in December 2027
The main requirements of the CRA – the provisions concerning cybersecurity and conformity assessment – will apply in Finland starting 11 December 2027. The essential cybersecurity requirements of the regulation will apply to products falling within the scope of the regulation that are placed on the EU market for the first time.
Conformity assessment means that the manufacturer must demonstrate that the product meets the essential cybersecurity requirements of the Cyber Resilience Regulation. The CRA includes product categories, and the assessment procedure depends on the product category. In most cases, the manufacturer can conduct the conformity assessment itself. Compliance is demonstrated through the CE marking.
Companies should ensure that procedures for identifying cybersecurity incidents, assessing their severity, assigning responsibility, and approving notifications are in place before the deadline takes effect. The consequences of non-compliance can be significant, such as a fine of up to 15 million euros or 2.5 % of the company’s global revenue from the previous year.
Manufacturers must, among other things:
- Take safety into account in the design phase – products must meet the relevant cybersecurity requirements;
- ensure that risk assessment guides the product’s development, manufacturing, and maintenance;
- have processes in place to address information security issues and provide fixes during the product’s support period (the same applies to importers, EU exporters, and distributors);
- prepare technical documentation – that is, compliance with requirements and risk management must be demonstrable;
- conduct a conformity assessment – that is, the product must undergo an appropriate assessment, an EU declaration of conformity must be prepared, and the CE marking must be affixed to the product in accordance with the regulations; and
- specify a support period – that is, the user must be informed of the timeframe during which the manufacturer commits to addressing vulnerabilities in accordance with the requirements of the regulation.
Not all products are subject to the same conformity assessment procedure. For particularly significant or critical product categories, the company’s participation in the assessment may be required. The procedure is determined based on the product’s classification and the requirements of the regulation.
What does the CRA mean for Finnish companies?
The obligations imposed by the CRA vary depending on the role of the operator. The CRA imposes different obligations on manufacturers, importers, distributors, and open-source software maintainers.
For manufacturers, the biggest change is that cybersecurity becomes part of a product’s compliance requirements. It is no longer enough to simply ensure a product’s functionality and technical quality; information security risks, vulnerability management, and maintenance procedures must also be documented and implemented in accordance with regulations.
Importers must ensure that the manufacturers of the products they bring onto the EU market have fulfilled the obligations set forth in the regulation. This includes, for example, conformity assessment, the necessary documentation, and the CE marking. This may particularly affect products imported from outside the EU and may even improve the competitiveness of companies operating in the EU’s domestic market.
Distributors must verify product markings, manufacturer and importer information, and the information provided to users. If a product does not meet the requirements, its availability on the market may be restricted due to the threat of severe penalties.
Software companies and actors in the open-source ecosystem must also assess their own position in relation to the CRA. Not all open-source software or its developers are automatically subject to the same CRA obligations. The regulation contains separate provisions for open-source actors that continuously support software development related to commercial activities.
For companies, the CRA effectively means the need to examine not only product development but also supply chains, contracts, information security processes, and the division of responsibilities. In particular, it is important to determine who is responsible for addressing vulnerabilities, how the security of software components is ensured, and how long security updates will be provided for products.
How can a company prepare for the CRA requirements?
Although the regulation will not take full effect until December 2027, preparation should not be left until the last few months. Vulnerability reporting obligations have been in effect since September 2026.
A company’s preparation can be divided into the following steps:
- Map out your company’s product portfolio and determine which devices, software, and components fall within the scope of the CRA.
- Define your company’s role. Determine whether you operate as a manufacturer, importer, distributor, or possibly in multiple roles.
- Conduct a cybersecurity risk assessment or have it done by an external party. Identify the vulnerabilities, dependencies, and necessary protective measures for different products.
- Develop a vulnerability management model – that is, define how reports are received, how they are technically investigated, how fixes are released, and how notifications are made to authorities.
- Ensure that documentation and assessment procedures are in place – that is, verify what technical documents, tests, and conformity assessments your products require.
- Review the supply chain and contracts. Ensure that the responsibilities of suppliers, subcontractors, and software component providers are clearly defined.
- Follow regulatory guidelines and standards. The EU’s harmonized standards and implementation guidelines support the practical implementation of these requirements.
Read more about our legal IT services
