Which EU rules apply to your product — and what is actually true?

Since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents — and this also applies to products placed on the market before December 2027.

Importers have their own duties: they may only place compliant products on the market, must verify documentation and CE marking, keep the EU declaration of conformity for at least 10 years and act on known vulnerabilities. If you sell under your own name or trademark, you are considered the manufacturer.

Non-commercial open-source software itself is largely outside scope. But a manufacturer that integrates open-source components into a commercial product is responsible for them and must exercise due diligence.

Most products allow self-assessment. Only “important” products (classes I and II, e.g. routers, microcontrollers with security functions, firewalls) may need third-party assessment; “critical” products may require European cybersecurity certification once a delegated act requires it — until then the class II procedures apply. The categories are listed in Annexes III and IV of the CRA; their technical descriptions are set out in Implementing Regulation (EU) 2025/2392.

They apply to every product placed on the market before 11 December 2027, and market surveillance can still act on those products afterwards.

If the device can communicate over the internet via another device — e.g. a phone app or a gateway — it can be in scope.

A compliant module helps, but the product placed on the market is assessed as a whole — including its software, interfaces and default settings.

Purely professional products are outside scope. But products likely to be used by consumers — e.g. smart meters, sensors, tools, chargers sold openly online — are covered.

Marketplaces have their own duties, but they do not replace the manufacturer, importer or EU responsible person. If your company is established in the EU and places goods from a non-EU country on the EU market, you are the importer.

It explicitly covers non-personal machine and sensor data too. GDPR continues to apply in parallel where personal data is involved.

Industrial machines, meters, agricultural equipment and vehicles are typical connected products under the Data Act.

As of the last review the Data Act amendments are still a proposal in negotiation. The access-by-design duty applies unchanged to products placed on the market after 12 September 2026.

You may not be directly regulated, but your NIS2 customers must secure their supply chain — they will pass requirements on to you contractually.

Manufacturing of computers, electronic and optical products, electrical equipment, machinery and vehicles is a listed sector (important entities).

Under the new directive software — including AI systems and firmware — is explicitly a product.

Liability towards the injured person cannot be limited or excluded by contract.

Industry associations requested a postponement, but it has not been adopted (status at last review). What was shifted to 2028 are the AI-specific requirements (via Regulation (EU) 2026/1744). Plan for 20 January 2027.

Machines placed on the market before 20 January 2027 stay legal. Each unit placed on the market from that date must comply with the regulation.

Mainly the high-risk obligations were postponed (plus, for systems placed on the market before 2 August 2026, the marking of generated content until 2 December 2026). Prohibitions, AI-literacy measures, general-purpose AI rules and the other transparency duties already apply.

Whoever first makes the battery available in a Member State — also inside an appliance — is the producer for extended producer responsibility. For imports that is usually the importer.

Registration is per country and per role. Only a registration (or an authorised representative) that covers your sales in Austria counts — check the EDM register.

The PPWR covers all packaging, including transport, sales and industrial (B2B) packaging.

The control list is based on technical parameters, not intended use; catch-all controls can also capture unlisted items because of their end use. The 2026 update adds, for example, rotary encoders based on inductive sensing and advanced computing integrated circuits.

Importing itself requires no licence under the regulation, but re-export, delivery of spare parts or remote technical support to non-EU sites can require one — and sanctions screening applies in any case.