Free check

If you release software, this applies now

Since 11 September 2026, the Cyber Resilience Act has required you to report a security flaw in your product within 24 hours of finding out attackers are using it. That includes products you released before then.

Five questions. Your answers stay on this page unless you ask us to email you the result. No account needed.

FourWinds Digital · fourwindsdigital.com

Cyber Resilience Act check

Regulation (EU) 2024/2847

This result was worked out from the answers given on the page. It shows which rules you need to look at. It is not legal advice, and it was up to date on the day it was printed.

This result is worked out from your own answers. It shows which rules you need to look at. It is not legal advice, and it does not confirm that you comply.

What was answered

Optional, and it does not change the result. If you print the result, the name appears on it, so the page shows which product it was for.

Does a customer install, embed or run any part of it themselves?
01Does a customer install, embed or run any part of it themselves? Not answered

Does a customer install, embed or run any part of it themselves?

For example a desktop program, a mobile app, a browser extension, firmware, software that runs on the customer's own servers, or a code library you supply separately. Answer no if everything runs on your servers and the customer only ever uses a browser.

Did you make it, or is your name on it?
02Did you make it, or is your name on it? Not answered

Did you make it, or is your name on it?

Building it counts, having it built for you counts, and putting your own name or trademark on somebody else's product counts. Reselling under their name does not.

Do you make money from it, in any way?
03Do you make money from it, in any way? Not answered

Do you make money from it, in any way?

For example charging for it, charging more than your costs for support, earning money from a platform built around it, or requiring data for anything other than making it work. If it is free and earns nothing in any of those ways, the Act does not cover it. Donations that go beyond your costs do count.

Is its main job one of these?
04Is its main job one of these: password manager, VPN, single sign-on or multi-factor authentication, network management, SIEM, antivirus, browser, boot manager, firewall, intrusion detection, hypervisor or container runtime, operating system, router, smart home camera or lock, connected toy, health wearable? Not answered

Is its main job one of these?

Password manager, VPN, single sign-on or multi-factor authentication, network management, SIEM, antivirus, browser, boot manager, firewall, intrusion detection, hypervisor or container runtime, operating system, router, smart home camera or lock, connected toy, health wearable.

Is any version already in customers' hands?
05Is any version already in customers' hands? Not answered

Is any version already in customers' hands?

Anything shipped, downloaded or installed before now, including versions you no longer actively sell.

Answer all five questions and the result appears here.

Two things to check

First, what it covers. Software that only runs in a web browser is outside the Act. But if you release a mobile app, the server it talks to is covered too. Second, the date. Reporting started on 11 September 2026, fifteen months before the rest of the requirements. It also applies to products built long before the Act came in.

As at 31 August 2026, we had found no published notice naming the Irish body that will enforce it (the market surveillance authority). That changes who chases you, not what is due.

Using AI but not releasing software? The AI Act transparency check is the other free check with a deadline.

Talk to us about the reporting process