Alexandre Bloch
Co-founder & CTO, Engineering
CE Marking for Digital Products: What Changes in 2026
The Cyber Resilience Act extends the CE marking framework to software and connected devices for the first time. For tech companies, this means a fundamentally new product compliance requirement.
What the Cyber Resilience Act changes
Traditionally, CE marking applied to physical products: machinery, medical devices, electronics. The CRA extends this to "products with digital elements", a broad category that includes standalone software, IoT devices, connected hardware, and SaaS products that interact with end-user devices. Manufacturers must demonstrate compliance with essential cybersecurity requirements through a conformity assessment process.
Secure by default: products must ship with secure configurations out of the box
Vulnerability handling: documented processes for identifying, reporting, and patching vulnerabilities
Security updates: free updates for the expected product lifetime (minimum 5 years)
Conformity assessment: self-assessment for most products, third-party for critical ones
Timeline and preparation
The CRA was adopted in 2024, with a transition period giving manufacturers until 2027 to fully comply. However, preparation must start now: vulnerability handling processes, SBOM (Software Bill of Materials) generation, and secure development lifecycle practices take months to implement. Cleo helps by mapping the CRA requirements to your specific product portfolio and tracking evolving implementation guidance from ENISA and market surveillance authorities.
Frequently asked questions
Does CE marking apply to software in 2026?
Yes. The Cyber Resilience Act (CRA) extends CE marking requirements to products with digital elements, including standalone software, connected devices, and IoT products. Manufacturers must demonstrate compliance with cybersecurity requirements through conformity assessment, implement vulnerability handling processes, and provide security updates throughout the product lifecycle.
Related resources
Solutions
Product Compliance SolutionTry Cleo: free regulatory risk scan
See your regulatory landscape mapped in minutes. No signup, no credit card.
