The Cyber Resilience Act makes product support part of the sale

Article 2 covers products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network. The definition includes software, hardware and qualifying remote data processing solutions. It also reaches components placed on the market separately. A manufacturer could not assess its position simply by calling itself a software company or describing a feature as connected.

The boundaries still mattered. The law contains exclusions for products covered by specified sectoral regimes and distinguishes commercial supply from other activity. A startup needed to map the actual product, its network dependencies and the role of each party selling it. A cloud function necessary for a device to perform one of its functions could raise different questions from an unrelated hosted service. Broad claims that every digital service faced identical duties would obscure that analysis.

The adopted text requires manufacturers to exercise due diligence when integrating third-party components, including noncommercial open source components. Annex I also calls for a machine-readable software bill of materials covering at least top-level dependencies. The practical benefit is an ability to identify where a component sits inside a shipped product. A list that is disconnected from product versions or build records cannot reliably answer that question.

Consider a manufacturer learning of a vulnerability in a library shared by several device models. It needs to determine which versions contain the library, whether the weakness matters in their operating environment and which users need a fix. It then has to test and distribute the remedy. This sequence explains why software supply chain tools need links to engineering and release systems, beyond producing a document for procurement.

Investors needed to assess whether a company's product margin and staffing plan could sustain its commitments to existing customers. Fast shipment growth could increase future support work even if the development team stayed small. A clearer view of supported versions, upstream dependencies and expected product life could therefore improve the assessment of operating costs.

There was room for businesses that reduced this work through reliable inventories, secure updates and coordinated vulnerability handling. The law did not guarantee demand for a separate tool at every step. A useful product would need to fit the manufacturer’s existing engineering systems and make a concrete task easier. A manufacturer needed to maintain what it had already sold while continuing to build the next product.