Photo by Cristofer Maximilian on Unsplash
If your first instinct when you heard "EU Cyber Resilience Act" was to file it under "not my problem, we left the EU" -- you are in good company. A lot of UK business owners have done exactly that. But this particular regulation has a way of reaching across borders, and the reason is simple: the technology products your business runs on are mostly built by global manufacturers who sell into Europe. They are not going to build two different versions of their software or hardware. The standard that satisfies Brussels becomes the standard you get too.
What the Cyber Resilience Act Actually Requires
The EU's Cyber Resilience Act (CRA) applies to any product with a digital component that is sold into the EU market. That covers a wide range of things: routers, connected printers, business software, mobile apps, smart devices, and more. The core shift is this -- manufacturers can no longer ship a product and consider their security obligations finished. The CRA introduces three requirements that matter most in practice:
- No default passwords. Products must not ship with generic credentials that every buyer shares. Every device needs a unique or user-configured password from the moment it leaves the box.
- Security updates are no longer optional. Manufacturers must provide patches for the supported lifetime of the product and ensure those patches can reach users.
- 24-hour vulnerability reporting. When a manufacturer discovers a flaw that is being actively exploited in their product, they have 24 hours to report it to the EU's cybersecurity agency. That is a tight window by design -- it is intended to get the right people informed fast, before attackers can maximise the damage.
Why This Still Lands in UK Businesses
The products sitting in your office right now -- the Wi-Fi router, the cloud software subscription, the endpoint security tool -- almost certainly come from manufacturers who sell across Europe. When those manufacturers redesign their products to meet the CRA, you get the benefit of that as a customer. Stronger out-of-box security, mandatory update channels, and clearer disclosure when something goes wrong.
There is also the export side. If your business produces any product with a digital component and you want access to EU customers, the CRA applies to you directly. That scope catches more UK SMEs than people expect. Custom software, a connected piece of equipment, even a physical product with an embedded app could fall under it. If you are unsure whether your product is in scope, that is worth checking with a specialist before making assumptions either way.
The 24-Hour Clock Is the Part That Changes Things Most
For most small businesses, the 24-hour reporting requirement is not something you will ever interact with directly. It operates between the manufacturer and the regulator. But it creates a faster chain of events that reaches you.
When a manufacturer has to report an actively exploited flaw within 24 hours, the pressure to release a working fix accelerates sharply. That means patches arriving faster than they used to. But here is the part the regulation cannot fix on your behalf: a patch sitting uninstalled on your devices does nothing. One of the most consistent gaps we see in small business security is not a shortage of available updates -- it is that patches arrive and sit unapplied for days or weeks because nobody has the time or process to deal with them promptly.
The CRA compresses the window between a flaw being found and a fix being made available. What you do with that fix once it arrives is still entirely on your side of the fence. Automated patch management is worth thinking about seriously here -- if fixes are landing faster, the gap that matters most is the one between release and installation across every device in your business.
Default Passwords: An Old Problem the CRA Finally Forces Out
The default password ban is, frankly, long overdue. Devices shipping with generic credentials like "admin" or "password1234" have been a known attack vector for years. Exploiting them does not require any real technical skill -- just a list of common defaults and a willingness to try them. Yet manufacturers kept doing it because there was no rule telling them they had to stop.
The CRA changes that for new products sold into the EU. But it does nothing for the hardware already running in your office right now. If your router, your network-attached storage, or any other connected device was bought before these rules applied, checking whether those factory defaults were ever changed is still a sensible thing to do. Our post on router firmware and default credentials covers the basics if you want a practical starting point.
What the CRA Does Not Cover
It is worth being clear-eyed about the limits of this regulation. The CRA makes the products you buy more secure by design. It does not cover your own internal practices -- the strength of your team's passwords, how you manage access to sensitive data, whether your backups are actually tested, or how well your staff would handle a phishing attempt. Those gaps sit entirely outside the scope of any product regulation.
If you want to understand where the real vulnerabilities in your own environment are -- not just in the devices you buy -- vulnerability scanning is a practical way to get an honest picture rather than guessing.
A Practical Takeaway
The EU's Cyber Resilience Act is a genuine step forward for product security. Manufacturers being held accountable for flaws, banned from shipping with weak default credentials, and required to disclose active vulnerabilities quickly -- these are changes the industry needed. UK businesses will benefit from better products as a result, regardless of where those products are sold.
But the regulation closes a gap in the supply chain, not a gap in your internal security posture. The 24-hour clock makes better patches arrive faster. Applying them consistently, understanding your own exposure, and keeping your team aware of how attacks actually happen -- that part has always been your responsibility, and it still is.