The Cyber Resilience Act in your industry.

A machine builder that combines controllers, HMIs and remote access into its own machine becomes that machine's manufacturer under the Cyber Resilience Act, with duties that last as long as the machine line is supported.

App-connected appliances, bike computers and headphones are default products under the Cyber Resilience Act. Kids' watches are always class I, fitness bands only with health tracking. Without a fully applied harmonised standard, common specification or certification, a notified body then assesses them (Art. 32(2)). Book that slot early.

Under the Cyber Resilience Act most devices in this sector are default products; the smart meter gateway is the critical exception. Kunnus gives you one place for classification, vulnerability tracking and reporting on every product you have shipped, installed units included.

For suppliers of drives, sensors, I/O modules, controllers and chips: most components are default class under the Cyber Resilience Act. Classes I and II cover network interfaces, routers, managed switches, firewalls and chips with security functions; secure elements are critical. With the duties of the component maker and the documents OEMs need.

A company selling a tractor, implement or sensor with software and a data connection under its own brand is that product's manufacturer under the Cyber Resilience Act.

For router, modem, switch and firewall makers: where your product lines are likely to sit in Annex III of the Cyber Resilience Act. That placement decides whether self-assessment is an option.

Installed clients, mobile apps and SDKs are products under the Cyber Resilience Act, a backend can belong to one as remote data processing, and your own open-source projects count once you monetise them. With that settled, your release process sets how much documentation an update creates.

From a bootloader sold on its own to the finished device, two things set the workload of every embedded variant under the Cyber Resilience Act: its product class and the length of its support period.

Thermostats, bulbs, smart plugs and smart TVs are default products under the Cyber Resilience Act. Class I applies to devices that protect physical security at home, such as locks, cameras and baby monitors, and to voice assistants.