EU Cyber Resilience Act and Building Controls: What OEMs Should Do Now

Manufacturers of connected products sold in the EU, regardless of where they are based, have had a new obligation under the Cyber Resilience Act (CRA) since September 11, 2026. When they become aware of an actively exploited vulnerability or a severe incident, they must send an early warning within 24 hours and a fuller notification within 72 hours.

Here is what that means for building controls, and who on your team needs to act.

Why the EU Cyber Resilience Act Reaches Building Controls Already in the Field

The reporting duties apply to products already on the market, and the European Commission has clarified that they persist after a product’s support period ends.

A product is covered if it is designed, or reasonably expected, to connect to a device or network. The connection can be direct or indirect, and Wi-Fi and Bluetooth count, according to law firm Travers Smith.

Refindustry lists building automation and control systems, ventilation controllers and IoT gateways among potentially affected equipment. It adds that applicability depends on intended use and legal exclusions.

If your name is on the product, the responsibility is yours, even if someone else builds it. Missing the reporting deadlines can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. The remaining CRA requirements apply from December 11, 2027. They include building security into the product, handling vulnerabilities for at least five years (less if the product’s expected life is shorter), and CE marking. The technical standards that explain how to meet them are still being finalized.

Preparing starts with knowing exactly what you have in the field.

What Engineers Can Do

Start with an inventory. List every controller, gateway and display with a wired or wireless network interface, along with its firmware version, third-party libraries and update path. A deployed board with no update path cannot be patched. That can turn a single reportable vulnerability into a long-term exposure.

Awareness starts when an initial assessment gives reasonable certainty that a vulnerability is being exploited. Keep firmware version records and logs that let a team reach that conclusion in hours, not days. For new designs, treat secure firmware update capability as a DFX requirement from the first schematic review. Once engineering knows what is exposed, someone has to own the response.

What Product Managers Can Do

Pick one person to own vulnerability reports. Decide who reviews a report, who confirms the flaw is being exploited, and who files the notice. The process has to work nights and weekends, because a report can arrive at any hour.

Reports go through ENISA’s Single Reporting Platform, which went live on September 11. You only have to register when a notice is due, but Travers Smith advises setting up access now.

Also decide which older products you will keep monitoring. That is a product decision, not just an IT one. A fast response also depends on the people who supply your components.

What Buyers Can Do

When an actively exploited vulnerability sits in a third-party component, the manufacturer must still report it while you wait for supplier information. The 24-hour deadline does not pause while it waits for supplier information. Add four questions to supplier and manufacturing partner reviews:

1. Who receives vulnerability notices for the components and firmware you supply?
2. How quickly can you provide information and a fix?
3. How are firmware updates delivered to units already installed?
4. What happens to support at end of life?

A partner who cannot answer these clearly creates risk during the reporting window.

Key Takeaways

• The CRA applies to connected products sold in the EU, wherever the manufacturer is based. Reporting duties started September 11, 2026 and cover products already in the field.
• An early warning is due within 24 hours of becoming aware of an exploited vulnerability or severe incident, and a fuller notice within 72 hours.
• Connected building controls with Wi-Fi, Bluetooth or network interfaces are likely in scope, depending on use and exemptions.
• Engineers should list every connected product and confirm each one has a firmware update path.
• Product managers should name one owner for vulnerability reports and set up platform access early.
• Buyers should write response times and update support into supplier reviews.
• The remaining requirements apply from December 11, 2027, but the technical standards for meeting them are still being finalized.