Does the Cyberresilience Act apply to your business?
The Cyberresilience Act is a European regulation that sets cybersecurity requirements for products with digital elements: devices and software that can connect to a network or another device. Whether that regulation affects your business depends mainly on two questions: do you sell such a product, and in what role do you do so — as a manufacturer, importer, distributor, or as a party that brings a product to market under its own brand.
An online shop that resells ready-made products without its own brand usually takes on the role of distributor, with different obligations than a manufacturer. As soon as you have a product made under your own brand or your own label, you can legally be classified as a manufacturer, even if you don't produce anything yourself. This text does not provide a definitive answer for your own situation — that is a matter for a lawyer or for the supervisory authority designated for this regulation.
What the regulation is precisely intended to govern
The Cyberresilience Act focuses on the lifecycle of a product: from design and development to updates after sale. The thinking behind it is that products with digital elements often contain vulnerabilities that only come to light after sale, and something needs to counter that: security that has been built in from the start, and a way to remedy vulnerabilities later. This therefore affects not only the technology of a product, but also how long and how you remain available after sale for reports and updates.
When this can be relevant for your business
The core of the regulation concerns products that contain software or that can connect to the internet, a network, or another device. Think of smart lighting, security cameras, routers, sensors for building management, or equipment operated via an app. An installation company that sells and installs such equipment, an online shop that carries smart-home products under its own brand, or an office that supplies IoT equipment to customers can fall within the scope of application. A business that exclusively provides services without bringing such a product to market itself usually does not need to ask itself questions about this regulation — although it remains true that this differs from case to case.
If you sell products under your own brand
This is precisely the point where many SMEs are affected contrary to their own expectations. An online shop that has a manufacturer in Asia produce a product and sells it under its own brand name is often treated as a manufacturer rather than a reseller for applicable regulations. This is the same shift that occurs in product safety and packaging: the role you take on determines which obligations apply to you, and that role is not always the one you would choose. Whether that also applies to the Cyberresilience Act for your specific product is stated in the official text and with the designated supervisory authority.
Why this rarely stands alone
A business that falls under this regulation often also falls under other regulations: product safety in general, possibly accessibility requirements if the product has a user interface, and personal data whenever the device collects or transmits data. That is precisely why it is useful to map out once which regulations apply to your business, rather than starting over with each question. reglia is the layer over the platforms that each treat their subject matter in detail; you can view an overview of the connected platforms to see which platform deals with which topic.
What reglia itself does and does not do with the data you enter for it, you can read on the page about how reglia works. Once you've filled in a company dossier, you don't need to do that again for each platform, and you remain in control of which platform uses which data.
If you're unsure whether a product you sell falls under the Cyberresilience Act, that's a question for a lawyer or the supervisory authority designated for this purpose. On the page with frequently asked questions you'll find more explanation about what reglia does and doesn't answer for you.
If you want to know which platforms are available and which subject each covers, feel free to continue at creating a free account to see what's available for your business.