Published on
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity rules for hardware and software with a data connection. Its reporting obligation has applied since 11 September 2026, also to products already on the market. If you manufacture outside the EU and sell through the Netherlands, agree now with your Dutch importer how you report within 24 hours.
Part of our overview of EU product law for companies selling into the Netherlands.
Who does the Cyber Resilience Act apply to?
The Cyber Resilience Act applies to hardware and software products whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1) Regulation (EU) 2024/2847).
Medical devices, motor vehicles, aviation and marine equipment, identical spare parts and national security products fall outside (Article 2(2)–(4), (6)–(7)).
| Role | Core obligation | Article |
|---|---|---|
| Manufacturer: markets the product under its own name or trademark, also free of charge | design to Annex I, documentation, CE marking, reporting | Art. 3(13), 13, 14 |
| Authorised representative (written mandate) | tasks in the mandate, at least documentation and cooperation | Art. 18 |
| Importer: established in the EU, places on the market a product bearing the name or trademark of a company outside the EU | checks conformity; informs you of vulnerabilities | Art. 3(16), 19 |
| Distributor | checks the CE marking and documents | Art. 3(17), 20 |
| Every economic operator | names its supplier and customer on request, for 10 years | Art. 23 |
Apart from reporting (Article 14), these obligations apply from 11 December 2027.
“Important products” in Annex III need a stricter conformity assessment (Article 7(1)). For radio equipment, see the Radio Equipment Directive. The CRA covers products; NIS2 and the Dutch Cyberbeveiligingswet cover organisations.
What changes for a manufacturer outside the EU?
Articles 13 and 14 apply to every manufacturer whose product is made available on the EU market, wherever it is established (Article 2(1)). Without an EU main establishment, your chain decides which CSIRT receives your notifications (Article 14(7)).
You report through ENISA’s single reporting platform, simultaneously to the CSIRT designated as coordinator and to ENISA (Articles 14(1), 16(1)). Without a main establishment in the Union, the Member State follows this order (Article 14(7)):
- the Member State of your authorised representative for the largest number of your products;
- otherwise, that of the importer with the largest number of your products;
- otherwise, that of the distributor with the largest number;
- otherwise, the Member State with the most users.
A business outside the EU often thinks the reporting obligation only applies once it has an establishment in Europe. That is not right: without an establishment, your chain in Europe, your authorised representative or your importer, determines where you report. So record that in advance with your Dutch partner.
From 11 December 2027 your Dutch importer may place only conforming products on the market. Before it does, it must check the conformity assessment, the technical documentation, the CE marking and the EU declaration of conformity (Article 19(1)–(2)), and when it learns of a vulnerability, it must inform you without undue delay (Article 19(5)).
From 11 December 2027, an importer or distributor that sells your product under its own name or trademark, or carries out a substantial modification, is treated as the manufacturer and must comply with Articles 13 and 14 (Article 21). Article 22 does the same for any other party that substantially modifies the product and makes it available, for the modified part or, where security as a whole is affected, the whole product.
When a Dutch distributor wants to sell under its own brand, I always warn it before the first unit leaves under its name. My rule of thumb: if its name goes on the product, or it changes the software so that security works differently, it is the manufacturer, with the reporting obligation and the documentation that come with it. That need not be a problem. My advice to that distributor: agree with the original manufacturer that it receives the technical documentation, that the manufacturer reports vulnerabilities to it directly and that the manufacturer keeps supplying the updates. Then it can actually fulfil its role.
Do you need an authorised representative in the Netherlands?
The Cyber Resilience Act does not require a non-EU manufacturer to appoint an authorised representative. Article 18(1) says a manufacturer “may, by a written mandate, appoint an authorised representative” (Article 18).
Your core manufacturer obligations cannot be part of the mandate: design to Annex I, risk assessment, support period, security updates, technical documentation and conformity assessment stay with you (Article 18(2) with Article 13(1)–(11), (12) first subparagraph and (14)). At minimum, the representative keeps the declaration of conformity and technical documentation available for at least 10 years, provides information on a reasoned request and cooperates with market surveillance authorities (Article 18(3)).
A representative does determine where you report: the Member State where it is established comes first in Article 14(7). See also appointing an EU authorised representative in the Netherlands.
When does the Cyber Resilience Act apply?
The Cyber Resilience Act applies in stages: the reporting obligation of Article 14 since 11 September 2026, the rest of the regulation from 11 December 2027 (Article 71(2)).
| Event | Date | Source |
|---|---|---|
| Adoption | 23 October 2024 | final formula |
| Publication in the Official Journal | 20 November 2024 | OJ L 2024/2847 |
| Entry into force | 10 December 2024 | Art. 71(1) |
| Rules on notification of conformity assessment bodies (Chapter IV, Art. 35–51) | 11 June 2026 | Art. 71(2) |
| Reporting obligation of manufacturers (Art. 14) | 11 September 2026 | Art. 71(2) |
| Rest of the regulation | 11 December 2027 | Art. 71(2) |
| Products placed on the market before 11 December 2027 | other requirements only after a substantial modification; Art. 14 applies to all of them | Art. 69(2)–(3) |
From 11 December 2027 you must, among other things, design to Annex I (Article 13(1)), set a support period of in principle at least five years (Article 13(8)) and keep each security update available for at least 10 years after it is issued, or for the rest of the support period if that is longer (Article 13(9)).
Two further acts have been adopted. Implementing acts on the format of the software bill of materials (SBOM, Article 13(24)) and of notifications (Article 14(10)) may follow; we found none as of 29 October 2026.
The reporting protocol comes first. The reporting obligation already applies, also to products that have been on the market for years. A one-page protocol is enough: who decides, who reports, who informs the customers, and who obtains the information from a supplier. Then the contracts, because they decide who pays the bill. The other way round goes wrong: then you have a neat indemnity, but you miss the 24 hours.
How does the Cyber Resilience Act work in the Netherlands?
The Cyber Resilience Act applies directly in the Netherlands. Dutch supervision and fines are set in a bill, not yet law: the Uitvoeringswet verordening cyberweerbaarheid (Kamerstukken 36 875).
The Tweede Kamer (House of Representatives) adopted it on 10 September 2026 (vote). It is now before the Eerste Kamer (Senate) in written preparation; committees submitted their input on 27 October 2026 (status at the Eerste Kamer). A Royal Decree (koninklijk besluit) will set its entry into force (Article 6.2).
- The Minister of Economic Affairs becomes the market surveillance authority (Article 2.2).
- The CSIRT designated under Article 17(1) Cyberbeveiligingswet becomes the coordinating CSIRT (Article 2.3).
- The regulator would be able to impose an administrative fine up to the CRA maximums and an administrative enforcement order (last onder bestuursdwang), which under Article 5:32 Awb can also take the form of an order subject to a penalty (last onder dwangsom) (Article 3.7).
- Objection (bezwaar) and appeal (beroep) follow the Dutch General Administrative Law Act (Algemene wet bestuursrecht, Awb) (Article 5.1).
According to the explanatory memorandum, the Rijksinspectie Digitale Infrastructuur (RDI) will carry out these tasks in practice and the NCSC is expected to run the reporting desk (Kamerstukken 36 875, nr. 3). The memorandum adds that the NCSC could have a reporting desk running from 11 September 2026, provided the necessary conditions were met in time.
The CRA sets the maximum fines: for breaches of the Annex I requirements or Articles 13 and 14, up to EUR 15 000 000 or, for a company, 2.5% of its worldwide annual turnover for the preceding financial year, whichever is higher (Article 64(2)). Micro and small manufacturers are not fined for missing the 24-hour deadline (Article 64(10), as corrected on 2 July 2025).
Has your Dutch importer asked for a reporting arrangement, or blocked a shipment? I can set out your reporting route under the CRA and record the roles in your Dutch contracts before the next shipment: contact me as your product law partner in the Netherlands.
What do you do when a vulnerability in your product is actively exploited?
When a vulnerability in your product is actively exploited, you send an early warning within 24 hours of becoming aware of it, a vulnerability notification within 72 hours and a final report later (Article 14(2)).
A vulnerability is actively exploited when there is reliable evidence that a malicious actor exploited it without the system owner’s permission (Article 3(42)). The 24-hour and 72-hour deadlines also apply to a severe incident having an impact on the security of your product; the final report is then due within one month of the incident notification (Article 14(3)–(5)).
| Notification | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | within 24 hours | within 24 hours |
| Notification | within 72 hours | within 72 hours |
| Final report | no later than 14 days after a corrective measure, or a measure that limits the risk, is available | within one month after the incident notification |
You must also inform affected users, and where appropriate all users (Article 14(8)).
First the vulnerability itself, then the notification, and the two run side by side. My first question is who in your company decides that this is an actively exploited vulnerability, because from that moment the 24-hour clock runs. Then three steps:
- the early warning through the reporting platform, businesslike and factual, without guessing at cause or fault;
- informing your customers and users, with what they can do themselves;
- holding your own supplier to account if the vulnerability comes from its component.
A notification is not an admission of fault. Whoever reports on time and clearly stands stronger later than whoever waits.
From 11 December 2027 the regulation says so expressly: the mere act of notification does not expose you to increased liability (Article 17(4)), and CSIRTs offer helpdesk support, in particular to micro, small and medium-sized enterprises (Article 17(6)).
What can you arrange yourself, and where do you need a technical adviser?
You can arrange much yourself: check for an EU main establishment, map your representative, importer and distributor per market, and set up a reporting protocol (Article 14(7)).
The Annex I requirements, risk assessment and testing belong with your engineers, a security adviser or a conformity assessment body. From 11 December 2027 a non-conforming product must be corrected, withdrawn or recalled (Article 13(21)); see product recall in the Netherlands.
When do you need a Dutch lawyer for the Cyber Resilience Act?
You need a Dutch lawyer when you must agree with your Dutch importer, authorised representative or distributor who reports, who pays and who is liable, or when a Dutch regulator steps in (Articles 14(7), 19, 21).
| Your situation | What is at stake | Why a Dutch lawyer | What MAAK Advocaten does |
|---|---|---|---|
| No EU establishment and a vulnerability is exploited | reporting via the CSIRT your chain determines, 24 and 72 hours (Art. 14(2), (7)) | who supplies which information must be agreed in advance | record the reporting route with your importer or representative |
| You appoint an authorised representative | written mandate, minimum tasks (Art. 18) | the mandate is a contract: its scope, liability and governing law are negotiated | draft or review the mandate |
| Your importer blocks a shipment or demands an indemnity (vrijwaring) | from 11 December 2027 the importer places only conforming products on the market (Art. 19) | the contract with your Dutch importer sets roles, costs and indemnity | negotiate; agree on documentation |
| Your distributor wants its own brand | from 11 December 2027 it becomes the manufacturer (Art. 21) | who becomes manufacturer, who reports | establish the role; draft the contract |
| A Dutch regulator asks for information | bill 36 875, not yet law; Awb | acting in the Netherlands; objection and appeal | review documents, secure deadlines, zienswijze (written view) |
The agreement on information and security updates makes the most difference. In every contract I record three things:
- that your supplier reports a vulnerability in its component to you directly, with the details you need for your own notification;
- how long it supplies security updates, at least as long as your own support period;
- who bears the costs if a security update or a recall is needed.
An indemnity without that information clause is worth little: you then only learn that something is wrong when the deadline has already passed.
Example: connected cameras sold through a Dutch importer
For a non-EU manufacturer without an authorised representative, a Dutch importer handling most of its products makes the Dutch coordinating CSIRT the recipient of its notifications (Article 14(7)).
Suppose a US manufacturer sells connected cameras in the EU through one importer in Rotterdam, with no EU establishment or representative. In November 2026 it learns that a firmware vulnerability is being exploited.
Until 11 December 2027 the importer has no duty under the CRA to pass on vulnerabilities it learns of (that duty starts then, Article 19(5)), while the 24-hour early warning is already the manufacturer’s duty. If the contract does not say who passes on which information, both lose time.
This is a hypothetical example for illustration, not a description of a MAAK Advocaten case.
How does MAAK Advocaten work on Cyber Resilience Act matters?
MAAK Advocaten N.V., a law firm in Amsterdam, acts for non-EU manufacturers and their Dutch importers and distributors: contracts and mandates under Dutch law, and objection and appeal against a Dutch regulator.
In the first days we review documents, secure deadlines and prepare a zienswijze or bezwaar; in court we act at first instance and on appeal. If a regulator contacts you, this is my approach.
Quickly and constructively, but not hastily. I first establish the deadline and read exactly what is being requested; then we provide what was asked, complete and in order, and no more than that. If the regulator announces a measure, we submit a zienswijze setting out what you have already done to remove the risk. If it cannot be settled in discussion, bezwaar and beroep follow. My experience is that a regulator mainly wants to see that you take the risk seriously; a good file does more than a sharp letter.
Where liability is also at stake, see the EU Product Liability Directive.
Frequently asked questions about the Cyber Resilience Act
Does the Cyber Resilience Act reporting obligation already apply?
The reporting obligation in Article 14 of Regulation (EU) 2024/2847 has applied since 11 September 2026, also to products already on the market. The rest of the Cyber Resilience Act applies from 11 December 2027 (Articles 69(3) and 71(2)).
Do I need an EU authorised representative under the Cyber Resilience Act?
The Cyber Resilience Act allows a manufacturer to appoint an authorised representative by written mandate but does not require it (Article 18(1)). If you have no EU establishment, a representative comes first in deciding which CSIRT receives your notifications (Article 14(7)).
Where does a manufacturer without an EU establishment report a vulnerability?
A manufacturer without a main establishment in the EU reports to the coordinating CSIRT of the Member State where its authorised representative for the largest number of its products is established; failing that, its importer or distributor with the largest number of its products; failing that, the Member State with the most users (Article 14(7)).
Who supervises the Cyber Resilience Act in the Netherlands?
Dutch bill 36 875 would make the Minister of Economic Affairs the market surveillance authority. Adopted by the House of Representatives on 10 September 2026, it is now before the Senate and not yet law. According to the explanatory memorandum, the RDI would do this in practice and the NCSC is expected to run the reporting desk.
When should a non-EU manufacturer call a Dutch lawyer about the CRA?
A non-EU manufacturer should call a Dutch lawyer when its Dutch importer asks for a reporting arrangement or indemnity, when it appoints a representative, when a distributor wants its own brand, or when a Dutch regulator asks questions (Articles 18, 19, 21).
Primary sources
- Regulation (EU) 2024/2847, CELEX 32024R2847; Article 64(10) as corrected on 2 July 2025
- Implementing Regulation (EU) 2025/2392 on important and critical product categories
- Delegated Regulation (EU) 2026/881 on delaying the dissemination of notifications
- Dutch bill 36 875: Kamerstukken 36 875, A (Articles 2.2, 2.3, 3.7, 5.1, 6.2), explanatory memorandum, vote of 10 September 2026, status at the Eerste Kamer
Last checked on 29 October 2026 · next relevant date: 11 December 2027 (the rest of the Cyber Resilience Act applies)
Do you sell connected products into the EU without an EU establishment, and is it unclear who reports when something goes wrong? Put your situation to me through my page as product law partner in the Netherlands. — Martin Krüger
