What is settled and what is not

Annex I, Part I, point 2(b)Where applicable, ship with safe settings switched on, and let users put the device back to its original (factory) state.: Secure by default, with a reset to the original state

Where applicable, ship with safe settings switched on, and let users put the device back to its original (factory) state.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 8 October 2026

Annex I, Part I, point 2(c)Where applicable, the device must be able to take security updates. Where automatic updates apply as well, they are on by default, with an easy opt-out, a notice when an update is available and a way to postpone it. They do not apply to a product made mainly to be built into other products as a component, or to one whose users would not reasonably expect them, such as a product meant for professional ICT networks, especially critical and industrial ones where an automatic update could interfere with operations (recital 56; Commission FAQ 4.3.3); such a product must still be able to take security updates, and users must still be told about vulnerabilities and given updates without delay.: Vulnerabilities can be fixed through security updates

Where applicable, the device must be able to take security updates. Where automatic updates apply as well, they are on by default, with an easy opt-out, a notice when an update is available and a way to postpone it. They do not apply to a product made mainly to be built into other products as a component, or to one whose users would not reasonably expect them, such as a product meant for professional ICT networks, especially critical and industrial ones where an automatic update could interfere with operations (recital 56; Commission FAQ 4.3.3); such a product must still be able to take security updates, and users must still be told about vulnerabilities and given updates without delay.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 14 October 2026

Annex I, Part I, point 2(d)Where applicable, lock the device so only authorised users and systems get in, and report possible unauthorised access.: Protection from unauthorised access

Where applicable, lock the device so only authorised users and systems get in, and report possible unauthorised access.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 11 October 2026

Annex I, Part I, point 2(e)Where applicable, stop data from being read by anyone who should not see it, for example with encryption.: Confidentiality of data

Where applicable, stop data from being read by anyone who should not see it, for example with encryption.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 14 October 2026

Annex I, Part I, point 2(f)Where applicable, protect the device's data, commands, software and settings from changes the user has not authorised, and report corruption.: Integrity of data, commands, programs and configuration

Where applicable, protect the device's data, commands, software and settings from changes the user has not authorised, and report corruption.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 11 October 2026

Annex I, Part I, point 2(g)Where applicable, process only the data the product needs for its intended purpose.: Data minimisation

Where applicable, process only the data the product needs for its intended purpose.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 11 October 2026

Annex I, Part I, point 2(h)Where applicable, protect the availability of the device's core functions, under attack and after something goes wrong.: Availability of essential functions, including under attack

Where applicable, protect the availability of the device's core functions, under attack and after something goes wrong.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 8 October 2026

Annex I, Part I, point 2(i)Where applicable, keep the harm your device can do to the networks and devices around it to a minimum.: Limited impact on other devices and networks

Where applicable, keep the harm your device can do to the networks and devices around it to a minimum.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 11 October 2026

Annex I, Part I, point 2(j)Where applicable, limit the ways into the device, external interfaces included: fewer open doors means fewer ways to attack it.: Limited attack surfaces, including external interfaces

Where applicable, limit the ways into the device, external interfaces included: fewer open doors means fewer ways to attack it.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 11 October 2026

Annex I, Part I, point 2(k)Where applicable, build in mechanisms that make a vulnerability harder to exploit and limit the damage of an incident.: Exploitation mitigation to reduce the impact of an incident

Where applicable, build in mechanisms that make a vulnerability harder to exploit and limit the damage of an incident.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 11 October 2026

Annex I, Part I, point 2(l)Where applicable, keep a security log of what happens on the device, and let users switch it off.: Security logging and monitoring, with a user opt-out

Where applicable, keep a security log of what happens on the device, and let users switch it off.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 8 October 2026

Annex I, Part I, point 2(m)Where applicable, let users wipe the device completely, and move their data safely if they move it at all.: Secure, easy and permanent deletion of data and settings

Where applicable, let users wipe the device completely, and move their data safely if they move it at all.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 8 October 2026

Annex I, Part II, point 1Identify and document the software inside your product and its vulnerabilities, including a list of its components (SBOM) in a standard format.: Identify and document components and vulnerabilities, including an SBOM

Identify and document the software inside your product and its vulnerabilities, including a list of its components (SBOM) in a standard format.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 8 October 2026

Annex I, Part II, point 2Deal with each security problem without delay, with a remedy that follows the risk it poses: a security update where one is needed, and otherwise an advisory, a workaround or configuration guidance (Commission FAQ 4.3.1; the law does not require a patch for every vulnerability, and one your risk assessment shows cannot be exploited may only need recording). Where technically feasible, do not make users take new features to get a fix. Article 13(10) lets you fix vulnerabilities only in the version you last placed on the market if users of older versions can get that version free of charge and without extra cost to adapt their hardware or software set-up (in the Commission's draft guidance, staff time, routine testing and configuration changes are not extra cost; having to buy new hardware or replace infrastructure is), while the other Part II duties and the Article 14 reporting duties still cover every version; whether a device's firmware releases count as the "substantially modified versions" that article speaks of is not settled (our argument: only if every unit still in its support period can take the newest firmware).: Address and remediate vulnerabilities without delay

Deal with each security problem without delay, with a remedy that follows the risk it poses: a security update where one is needed, and otherwise an advisory, a workaround or configuration guidance (Commission FAQ 4.3.1; the law does not require a patch for every vulnerability, and one your risk assessment shows cannot be exploited may only need recording). Where technically feasible, do not make users take new features to get a fix. Article 13(10) lets you fix vulnerabilities only in the version you last placed on the market if users of older versions can get that version free of charge and without extra cost to adapt their hardware or software set-up (in the Commission's draft guidance, staff time, routine testing and configuration changes are not extra cost; having to buy new hardware or replace infrastructure is), while the other Part II duties and the Article 14 reporting duties still cover every version; whether a device's firmware releases count as the "substantially modified versions" that article speaks of is not settled (our argument: only if every unit still in its support period can take the newest firmware).

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 14 October 2026

Annex I, Part II, point 3For as long as you support the product, review regularly whether new threats, new vulnerabilities or a change to the product call for new or repeated security tests, and run them when they do. On the Commission's draft guidance, this is not a fixed calendar of the same test.: Effective and regular security testing and review

For as long as you support the product, review regularly whether new threats, new vulnerabilities or a change to the product call for new or repeated security tests, and run them when they do. On the Commission's draft guidance, this is not a fixed calendar of the same test.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 13 October 2026

Annex I, Part II, point 4After you ship a fix, publish a security advisory that explains it.: Publicly disclose fixed vulnerabilities

After you ship a fix, publish a security advisory that explains it.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 7 October 2026

Annex I, Part II, point 5Publish, and follow, rules for how outsiders report security bugs to you and what happens next.: A coordinated vulnerability disclosure policy

Publish, and follow, rules for how outsiders report security bugs to you and what happens next.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 7 October 2026

Annex I, Part II, point 6Give security researchers an easy, published way to reach you.: Make it easy to report vulnerabilities, with a contact address

Give security researchers an easy, published way to reach you.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 7 October 2026

Annex I, Part II, point 7Deliver updates over a channel attackers cannot tamper with, so vulnerabilities are fixed or mitigated in a timely manner.: Secure distribution of updates

Deliver updates over a channel attackers cannot tamper with, so vulnerabilities are fixed or mitigated in a timely manner.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 8 October 2026

Annex I, Part II, point 8Security updates go out promptly and for free, with a note telling users what to do.: Security updates disseminated without delay, free of charge, with advisory messages

Security updates go out promptly and for free, with a note telling users what to do.

Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), checked 7 October 2026