The Cyber Resilience Act and UK Companies: What Applies If You Sell Software or Apps Into the EU
Guide · Compliance
Yes: if you’re a UK company and people in the EU can buy, download or install your software, the EU Cyber Resilience Act applies to you. Brexit doesn’t change that. The CRA is about where a product is sold, not where the company is based. Its reporting obligations have applied since 11 September 2026; everything else applies from 11 December 2027. For the wider picture, see the Cyber Resilience Act for app teams.
Last reviewed 29 September 2026. Not legal advice.
Does the Cyber Resilience Act apply to UK companies?
It applies to anyone who places a “product with digital elements” on the EU market: hardware and software that connects, directly or indirectly, to a device or network. That includes desktop software, mobile apps, games, firmware and connected devices. If you develop it (or have it developed) and market it under your name to EU users as part of a business, whether they pay for it or not, you are its manufacturer under the Act (Regulation (EU) 2024/2847), wherever you are established.
So a UK studio with an iOS app on the French App Store is in scope in the same way as a French studio. The only questions are what the product is and whether an exemption applies, not where you are.
What’s out of scope
- Pure SaaS: a service used only remotely, with nothing installed on the user’s device, generally isn’t a CRA product. A native app that talks to your backend is, and the backend processing it relies on can count as part of the product.
- Products covered by their own EU regime, such as medical devices, cars and aviation.
- Genuinely non-commercial open source.
- Software you build only for your own internal use and never supply to anyone else. Bespoke software you build for a client is in scope.
The UK has no CRA of its own (yet)
Three UK measures sound related. None of them replaces the CRA for products sold into the EU:
| Measure | What it covers | Status (Oct 2026) |
|---|---|---|
| Cyber Security and Resilience Bill | Updates the UK NIS rules for operators of essential services, managed service providers and data centres. It regulates organisations, not products. | In the House of Lords; third reading scheduled for 2 November 2026 (Parliament Bills API, checked 29 October 2026). Most duties would follow later, via secondary legislation. |
| PSTI Act 2022 (product security regime) | Minimum security for consumer connectable products sold in the UK: no default passwords, a way to report vulnerabilities, a stated update period. | In force since 29 April 2024. |
| Software Security Code of Practice (DSIT / NCSC) | Principles for software vendors: secure development, secure deployment, communication with customers. | Voluntary, published May 2025. |
If you sell into the EU, you meet the CRA regardless. Doing so also covers much of what the UK measures ask, because they share the same basics: a way to report vulnerabilities, security updates and secure defaults.
What a UK software or app company must do
Now: reporting (since 11 September 2026)
- If you become aware of an actively exploited vulnerability in your product, send an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix or mitigation being available (Article 14). Severe incidents affecting the product’s security follow a similar 24h / 72h / one-month rhythm.
- Reports go through ENISA’s single reporting platform. Without an EU establishment, the Act decides which national CSIRT receives them: the country of your authorised representative if you have one; failing that, your importer or distributor; failing that, where most of your EU users are.
- This applies to products already on the market, not just new releases.
- Micro and small enterprises can’t be fined for missing the 24-hour early-warning deadline specifically (Article 64). The obligation to report still applies.
By 11 December 2027: everything else
- Meet the essential requirements: secure by default, no known exploitable vulnerabilities at release, security updates, protection of data and integrity, a minimal attack surface.
- Handle vulnerabilities properly: a coordinated vulnerability disclosure policy, a published contact for reports, a software bill of materials (SBOM), and free security updates for the support period (at least five years unless the product is expected to be used for less).
- Prepare technical documentation and an EU declaration of conformity, and apply the CE marking. Most software is in the default category and can self-assess; some “important” and “critical” product types need more.
Do you need an EU representative?
Not under the CRA itself. Unlike GDPR, it lets a manufacturer appoint an authorised representative in the EU (Article 18) but doesn’t require one. Some teams appoint one anyway, because it gives market surveillance authorities and CSIRTs a clear point of contact.
How ready are UK app publishers?
Not very, on the most basic measure. In our September 2026 measurement of European App Store publishers (5,071 we could check), 31% of the 100 publishers on .uk domains published any way to report a vulnerability, and 24% had a security.txt. That’s behind the Netherlands (51%) and Germany (35%), and a long way from 100%. Small publishers everywhere were least ready: 12.1%. How we measure explains how these figures are produced and their limits.
A first week for a small UK team
- Check your scope and category for each product you sell into the EU.
- Publish a vulnerability contact: a
security.txtat/.well-known/security.txtand a short disclosure policy. - Name who reports an actively exploited vulnerability within 24 hours, and write down how.
- List what you ship: your dependencies and third-party SDKs, the start of an SBOM.
- Decide your support period and how updates reach users.
Frequently asked questions
Does the Cyber Resilience Act apply in the UK?
Not as UK law. It’s an EU regulation, so it doesn’t govern products sold only in Great Britain. (Northern Ireland’s position under the Windsor Framework is still being settled; check it if you sell there.) It does apply to UK companies for any product they make available in the EU.
Is there a UK equivalent of the Cyber Resilience Act?
Not a direct one. The PSTI regime covers consumer connectable products sold in the UK, the Cyber Security and Resilience Bill covers organisations such as managed service providers, and the Software Security Code of Practice is voluntary.
When does the Cyber Resilience Act apply?
It entered into force on 10 December 2024. Reporting obligations have applied since 11 September 2026, and the full requirements apply from 11 December 2027.
What are the fines?
Up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential requirements or the core manufacturer and reporting obligations (Articles 13 and 14). Lower caps apply to other breaches.
Does it apply to free apps?
Often. It covers products supplied in the course of a commercial activity, whether for payment or free of charge, so a free app from a company, or one funded by ads or in-app purchases, is typically in scope.
Last reviewed 29 September 2026. Source: Regulation (EU) 2024/2847 (the Cyber Resilience Act). This is general information about the Regulation, not legal advice for your situation.
Responses