Cyber Resilience Act · ten checks for your IoT stack
The CRA makes every end date in your IoT stack yours.
An IoT stack chosen this year ships in products in 2027 and 2028 and has to be supported well into the next decade. For every layer that ends up in your product, the obligation is yours, whoever wrote the code.
What the CRA asks of a connected product
Three obligations, for every layer you ship.
for security updates, month and year, stated when the product is sold.
Separate from feature updates where technically feasible; free unless agreed otherwise with a business user for a tailor-made product (Annex I, Part II, points 2 and 8).
when attackers exploit one of its vulnerabilities or a severe incident hits its security.
Who is covered
Almost every hardware or software product made available in the EU that connects to a device or a network.
Who is the manufacturer
Whoever markets the product under their own name or trademark, including an importer or distributor that rebrands it (Articles 3(13) and 21).
What is not covered
Medical devices, type-approved vehicles, certified aviation and marine equipment and products built only for national security or defence keep their own rules. Open source supplied outside any commercial activity is not covered.
What it can cost
Fines of up to EUR 15 millionor 2.5 per cent of worldwide annual turnover, whichever is higher (Article 64(2)). Without the requirements, no CE marking.
In force since 11 September 2026, for products already sold as well
Becoming aware of an exploited vulnerability or a severe incident starts a clock.
Articles 14 and 69(3)
The support period
When a supplier’s service ends, your support period runs on.
The time during which you owe security updates has to reflect the expected use, at least five years unless that is shorter, and its end date, month and year, has to be stated when the product is sold (Article 13(8) and (19)). From 11 December 2027 for every unit placed on the market from then on, including units of models designed earlier; earlier units only if substantially modified (Articles 3(30) and 69(2)).
Support period, if it matches the expected use: until at least December 2032. Four end dates set by others fall inside it.
After 2030 the axis is empty only because nobody has announced those dates yet · dates as given by AWS, Deutsche Telekom, Vodafone Germany, Microsoft
Ten checks, from the bottom up
Ten checks, layer by layer, cheap before the contract is signed.
For a request for quotation
Ten questions before the contract is signed.
0 of 10 answered in writing
Nothing you tick leaves this page.When part of the stack stops existing
Some checks fail anyway, years after the contract.
- 7 October 2026AWS set this as the end of support for its Greengrass V1 edge runtime.
- A supplier is soldas Semtech has agreed to sell its cellular module business to Compal, or goes insolvent.
- A project goes quietAn open-source project loses its last maintainer.
- A network is switched offTelekom plans to end 2G in Germany by 30 June 2028, Vodafone in September 2028, keeping it for critical IoT until the end of 2030.
None of that moves the obligations
Back into conformity, withdrawn or recalled.
A product that no longer meets the requirements during the support period has to be brought back into conformity, withdrawn or recalled (Article 13(21)).
Build in beforehand
An abstraction where an end date is most likely: cloud connectivity and device management.
A second source that has been qualified, not just named. For the modem, a pin-compatible second module is the real exit.
Escrow for what a supplier can deposit, released at end of support or change of control, rebuilt once to prove it works, toolchain included.
A fleet inventory: which software, at which SBOM version, on which device at which customer.
When it is announced
Use the inventory and the SBOMs to find the affected units and customers.
Work out the migration path, its cost and its re-certification, over the air or in the field.
Check whether the change is a substantial modification, one that adds cybersecurity risk the original assessment did not cover (Article 3(30)), and update the risk assessment (Article 13(3)).
Tell customers, before they read it elsewhere, whether the end date you gave them still holds.
Who is responsible
Procurement holds the contract until it is signed, product management the next release, engineering the current build. The fleet that shipped three years ago has no one.
I would give one person the fleet inventory, the end dates across the stack and the customer commitments, with the budget authority to fund a migration before it becomes urgent.
The one end date that is yours
Each part of the stack you choose this year comes with an end date you do not set. The one you state when the product is sold is the only one your customers will hold you to.
Your date from the calculatorAt least December 2032
Kai Hackbarth is an independent advisor and interim manager for IoT and connected products. FOTA for over four million vehicles; two years co-chairing the OTA special interest group.
Regulation (EU) 2024/2847 · Commission guidance C(2026) 5252 · sources in the article
Kai Hackbarth · kaihackbarth.com · October 2026