Making Tax Digital for Income Tax — Quarterly Update Due
US State Privacy Laws Check (Beyond California)
Why this matters.
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets the first EU-wide cybersecurity rules for “products with digital elements”: almost any hardware or software product placed on the EU market that connects to a device or network, from smart home gadgets and wearables to desktop and mobile apps, firmware and software sold as a product. It applies to manufacturers wherever they are based, and to importers and distributors. Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe security incidents in their products through the single reporting platform run by ENISA (Article 14): an early warning within 24 hours, a fuller notification within 72 hours and a final report afterwards. The main obligations, including the essential cybersecurity requirements in Annex I and CE marking, apply from 11 December 2027.
Products made now will still be on sale in 2027, so design decisions matter today. Manufacturers must build products secure by design with no known exploitable vulnerabilities, provide security updates for a support period that should normally be at least five years (Article 13(8)), keep a software bill of materials, run a vulnerability handling process, and prepare technical documentation and an EU declaration of conformity. “Important” and “critical” products listed in Annexes III and IV face stricter conformity assessment. Market surveillance authorities can force withdrawals and recalls, and fines reach €15 million or 2.5% of worldwide annual turnover for breaching the essential requirements (Article 64). This check shows whether the CRA applies to you and how ready you are.
