If your company supplies products with digital elements — think of a smart thermostat, software that comes with a machine, or an app that communicates with a device — the Cyberresilience Act requires a file that demonstrates how the cybersecurity of that product is assured. In broad terms, this involves a risk assessment of the product, technical documentation on how it works and its security, an overview of the software components used, a process for handling vulnerabilities, and a statement of conformity. The precise structure and terminology are set out in the official text of the regulation; consult that, or your supervisory authority, for the exact requirements for your product.
What distinguishes this file from, for example, a product safety file or a packaging file, is that it is not complete upon delivery. A product safety file describes a product as it leaves the factory. The cybersecurity file must also show what happens after that delivery: how you identify vulnerabilities, how quickly you release an update, and how you document that. This is the detail that matters most in this area, and where companies accustomed to one-time files most easily stumble.
What typically goes into the file
For most products with digital elements, a cybersecurity file amounts to a combination of the following components. A risk analysis that describes which cyber risks apply to the product and how they are addressed. A technical overview of the architecture, including which software and which third-party components it contains — often referred to as a software bill of materials, a list of all software components in the product. A description of the process by which you identify, assess and remedy vulnerabilities. And a statement in which you confirm that the product meets the applicable requirements.
Whether your product needs exactly these documents, and in what form, depends on the type of product and the category it falls into. This is a substantive question that falls outside what reglia does; for that, the text of the regulation or a lawyer is the right starting point. An initial orientation on which obligations may apply to your type of business can be found at the overview of connected platforms.
Why the update process deserves separate attention
Many of the other files that a company maintains are essentially a snapshot in time: you complete them, you keep them, and you update them if something material changes. The cybersecurity file calls for something different: an ongoing process that you can also demonstrate. Who reports a vulnerability, within what timeframe is it assessed, and how does an update reach the user? This is not something you write down once and then leave — it is a part of the file that continues to evolve as long as the product remains in use.
In practice, this means the file contains two types of information: fixed documents that change when the product itself changes, and an ongoing log that grows with each update or report. Companies that do not make this distinction risk having a file that looks complete on paper but in practice does not show how security has been maintained after delivery. Whether and how this applies to your product is best assessed together with a lawyer or the authority responsible for this.
One file, but not your only obligation
A digital product that you sell to consumers often touches more than just the Cyberresilience Act in practice. The same product data — specifications, country of destination, responsible person within your company — also appear in product safety, packaging, and sometimes in personal data. reglia does not fill in that regulation itself, but ensures that you fill in a company and product dossier once and that the platforms that actually deal with it substantively read that dossier instead of you typing it out four times. You can read how that works exactly and what reglia does and does not do with that data at the explanation of how reglia works.
Anyone who wants to know how data is secured and who has access to it will find that on the page about security and privacy. Creating an account is free and does not commit you to anything; whatever you subsequently use at a platform, you pay for there, at the rate that platform charges.
Curious about which platforms are connected to reglia and which part of your company each one touches? Check out reglia's frequently asked questions or take a look at the overview of available solutions.