What the regulation requires of manufacturers, importers, distributors and anyone who substantially modifies a product, including the support period, and the lighter regime for open-source software stewards.
The core manufacturer duties beyond the technical requirements: due diligence on third-party and open-source components, technical documentation, conformity assessment, CE marking, identification and contact details, user information, corrective action and record retention.
Setting the support period during which vulnerabilities are handled: the five-year minimum, how expected use time and other factors extend it, disclosing the end date at purchase, and how substantially modified software versions affect it.
What importers placing non-EU manufacturers' products on the EU market must verify (conformity assessment, technical documentation, CE marking, declaration, user information), plus vulnerability and risk notifications and 10-year record keeping.
The due care distributors must apply before making products available: checking the CE marking and the manufacturer's and importer's documentation, holding back nonconforming products, passing on vulnerability information and cooperating with authorities.
The light-touch regime for legal persons that systematically support free and open-source software intended for commercial use without placing it on the market: a documented cybersecurity policy, cooperation with authorities and limited reporting duties from December 2027.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.