Tracker entry M14: EU Cyber Resilience Act
Phasing in
EU
Next date
in 13 months
Full application
- Region
- EU
- Sector
- Readers and connected devices
- Imposed by
- European Parliament and Council
- Applies to
- All products with digital elements, including readers and RFID software
- Technology
- Applies to reader hardware and software
What the rule requires
Every product with digital elements, including readers, middleware and RFID software, needs secure-by-design development, vulnerability handling and security updates. Makers must already report actively exploited vulnerabilities.
Status: In force; reporting duties since 11 Sep 2026, full application 11 Dec 2027
What it means for RFID
The Cyber Resilience Act applies to RFID equipment itself rather than to the items being tagged. It covers every product with digital elements, including readers, middleware and RFID software, so reader makers, software vendors and integrators selling into the EU need secure-by-design development, vulnerability handling and a way to deliver security updates.
Reporting duties have applied since 11 September 2026, so makers must already report actively exploited vulnerabilities. Full application follows on 11 December 2027.
Vendors have begun to design for it. RFID News reported in May 2026 that Pepperl+Fuchs launched the IDENTControl Compact B40, a multi-frequency (LF, HF and UHF) evaluation unit it describes as CRA compliant, with software updates delivered through its web interface. Anyone specifying readers that will still be in service after 11 December 2027 can ask suppliers how updates and vulnerability reports will be handled.
Timeline
- Regulation enters into force
- Vulnerability and incident reporting obligations apply
- Full application
Our coverage
Sources
Official source: EUR-Lex
Last checked against the official source on 1 November 2026.
Newsletter
Get deadline alerts for this and every other RFID mandate
Every Thursday the RFID News weekly digest lists the deadlines coming up from the mandates tracker, alongside the week's deployments and launches.
Related rules
All 65 rules on the mandates tracker This rule in the tracker
Seen a change to this rule, or something we have wrong? Tell the newsroom
