PRODUCT CYBERSECURITY REGULATION
EU cybersecurity requirements for manufacturers, importers and distributors of products with digital elements.
01
Manufacturers, importers and distributors of products with digital elements placed on the EU market: hardware and software, including remote data processing that forms part of such a product. It entered into force on 10 December 2024; the vulnerability and incident reporting obligations apply from 11 September 2026; the remaining obligations apply from 11 December 2027. A UK manufacturer selling into the EU is a manufacturer under the Act.
02
Product classification (default, important or critical), the gap assessment against the essential cybersecurity requirements in Annex I, the secure development and vulnerability-handling process the Act requires, including the software bill of materials and the support period, the technical documentation, and the conformity route: self-assessment for default products, a notified body for the important and critical classes.
03
The manufacturer declares conformity for default products; a notified body assesses the rest. Goldline is not a notified body.
04
Delivered alongside ISO 27001 and, for AI products, ISO 42001.
05
Scoped on the diagnostic. Any third-party fee is paid direct.
Scoped on the diagnosticBring the contract, questionnaire or buyer request. The diagnostic establishes the scope and the evidence route.
We use cookies and similar technologies to measure how this site is used, to see which organisations visit and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible, Microsoft Clarity, which records session replays, and Apollo. Read our Cookies policy.