1Deadlines and scope

1.1 Connected devices in DACH

Germany’s mobile networks carried 86.1 million machine-to-machine (M2M) SIM profiles at the end of 2025, 17 % more than a year earlier.⁷⁸ That is about four fifths of the 106.4 million other active SIM profiles.⁷⁸ Austria counted 27.5 million M2M SIM cards at the end of 2025, twice the 13.8 million other SIM cards in use and more than three times the 8.4 million of the end of 2021. Some of them work in devices abroad.^{337, 338} In Switzerland, M2M subscriptions rose by 14.3 % to 5.2 million in 2024, while mobile subscriptions overall grew by 2.5 %.⁴⁸

These counts cover only devices on mobile networks. Tools and building devices that connect over BLE or Wi-Fi come on top. Worldwide, Ericsson counts 22.3 billion Internet of Things (IoT) connections at the end of 2025, of which 4.5 billion, about a fifth, are cellular.¹³⁴ Ericsson expects the total to more than double to 47.1 billion by 2031.¹³⁴

1.2 From reporting duties to full application

Vulnerability reporting under the Cyber Resilience Act (CRA) has applied since 11 September 2026, the Machinery Regulation applies from 20 January 2027 and the full CRA from 11 December 2027.^{167, 168, 171} Five legal acts set the pace: the CRA,¹⁷¹ the Data Act,¹⁷⁰ the Machinery Regulation,¹⁶⁸ the cybersecurity delegated act under the Radio Equipment Directive (RED)¹⁴¹ and the Batteries Regulation with its battery passport.¹⁶⁹ All five are regulations. They apply directly in Germany and Austria without national transposition, and to products from Switzerland as soon as those are placed on the EU market. Three of the six deadlines already apply, and the full CRA comes last (Figure 1). A product whose development starts now and which ships in 2028 has to meet all five acts at once.

A corrigendum moved the Machinery Regulation date from the original 14 January.¹⁶⁷ After an amendment, the RED delegated act has applied from 1 August 2025, one year later than first adopted.¹⁴⁵ Five of the eight application dates have passed, and the full CRA comes last (Table 1).

11 September 2026, CRA reporting. Article 14 applies fifteen months before the rest of the regulation.¹⁷¹ An actively exploited vulnerability or a severe incident requires an early warning within 24 hours and a notification within 72 hours.¹⁷¹ Both go through ENISA’s Single Reporting Platform, which has run since 11 September 2026.^{133, 156} The final report is due 14 days after a fix or mitigation is available, or for a severe incident one month after the notification.¹⁷¹ Reports go to the CSIRT acting as coordinator in the Member State of the main establishment, and ENISA receives them at the same time.¹⁷¹ Impacted users must be informed, where appropriate in a structured, machine-readable format.¹⁷¹ Open-source software stewards report only from 11 December 2027.¹⁵⁶

The duty also covers products placed on the market before 11 December 2027.¹⁷¹ It applies today to a tool sold in 2023 that is still in the field.

12 September 2025 and 12 September 2026, Data Act. Access by design and by default covers only products placed on the market after 12 September 2026.¹⁷⁰ The user’s rights to obtain data and to have it shared with a third party, by contrast, have applied since 12 September 2025 without a cut-off date for placing on the market. They therefore reach the installed base as well.¹⁷⁰

11 June 2026, CRA notified bodies. Member States have been able to notify conformity assessment bodies under the CRA since 11 June 2026.¹⁷¹ No body has been notified under the CRA so far.¹⁶¹ Germany has registered the BSI as its notifying authority, Austria has registered none.¹⁶¹

20 January 2027, Machinery Regulation. The Machinery Regulation replaces the Machinery Directive 2006/42/EC on this date.^{167, 168} Machinery placed on the market under the Directive before that date may still be made available afterwards.¹⁶⁸ The essential requirements on protection against corruption and on the safety and reliability of control systems are new for connected machinery.¹⁶⁸

18 February 2027, batteries. Batteries for light means of transport (LMT), industrial batteries above 2 kWh and electric-vehicle batteries placed on the market from this date need a battery passport with data on the individual battery, including data from its use.¹⁶⁹ All batteries need a QR code, and products with portable batteries must let the end-user remove and replace them.¹⁶⁹

1.3 Scope and exemptions

None of the exemptions takes a typical tool, machine, building device or tracker out of scope. The CRA excludes medical devices, vehicles, aviation, marine equipment and defence.¹⁷¹ The differences between products lie in the detail of each act.

CRA. The CRA covers products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network.¹⁷¹ Apart from the reporting duty, legacy products fall under the CRA only if they are substantially modified once it applies in full.¹⁷¹ EU type-examination certificates issued for cybersecurity requirements under other Union harmonisation legislation remain valid until 11 June 2028.¹⁷¹

RED delegated act. Since 1 August 2025, radio equipment that can reach the internet must protect the network.¹⁴¹ It must also protect personal, traffic and location data where it processes them.¹⁴¹ The act counts communication “via any other equipment”, so a Bluetooth tool that reaches the cloud through a smartphone app is covered.¹⁴¹ Medical and IVD devices are excluded from all requirements, and products under the aviation, vehicle type-approval and road-toll legislation only from data protection and fraud protection, not from network protection.¹⁴¹ Delegated Regulation 2026/339 repeals the act with effect from the day the CRA applies in full.¹⁵⁴ From then on a radio product answers to one cybersecurity regime, the CRA, instead of two.¹⁵⁴ Radio equipment placed on the market up to 10 December 2027 remains subject to market surveillance against the requirements of the delegated act.¹⁵⁴

Data Act. A connected product is an item that “obtains, generates or collects data concerning its use or environment” and can communicate them, and “whose primary function is not the storing, processing or transmission of data on behalf of any party other than the user”.¹⁷⁰ The access obligations of Chapter II do not apply to micro and small enterprises without large partner or linked enterprises. They reach medium-sized enterprises one year after they qualify as such or one year after placing a product on the market.¹⁷⁰ A small enterprise employs fewer than 50 persons, a medium-sized one fewer than 250.¹³⁸ Makers with 100 or more staff therefore gain at most one year’s grace per product.¹⁷⁰ The Commission’s Digital Omnibus proposal of 19 November 2025 would amend the Data Act. At the time of publication it is at first reading and not adopted.^{153, 174} The text in force applies.

Machinery Regulation. Cordless power tools and stationary machines meet the definition of machinery: an assembly with a drive system other than human or animal effort and at least one moving part.¹⁶⁸ Mandatory third-party assessment applies to six categories, among them safety components and embedded systems with self-evolving behaviour that use machine learning for safety functions.¹⁶⁸ Household appliances for domestic use, audio, video and IT equipment, office machinery and low-voltage switchgear are excluded insofar as they fall under the Low Voltage Directive or the RED.¹⁶⁸

Batteries Regulation. A portable battery is sealed, weighs 5 kg or less and is “not designed specifically for industrial use”.¹⁶⁹ Any battery above 5 kg that is not an electric-vehicle, LMT or starting, lighting and ignition (SLI) battery is an industrial battery.¹⁶⁹ Typical power-tool packs and tracker cells are therefore portable batteries and need no passport. A stationary home storage battery, by contrast, is an industrial battery and needs a passport above 2 kWh.

1.4 Status of harmonised standards

Of the five acts, only the RED has harmonised standards in the Official Journal, while none has been cited yet for the CRA or the Machinery Regulation (Table 2).^{136, 148, 151, 159} The CRA standardisation request asks for 41 standards, the first of them due on 30 August 2026.¹⁴⁷ ETSI has had 17 vertical CRA drafts in public enquiry since August 2026.¹³⁶ Depending on the product category, the enquiry closes between mid-September and mid-November 2026.¹³⁶

Class I products under the CRA may self-assess only if they apply harmonised standards, common specifications or a European certification scheme in full.¹⁷¹ Without them they need a notified body, which does not yet exist under the CRA. The gap therefore weighs most on these products.

1.5 Affected manufacturers and readiness

Of the 4,410 manufacturers in DACH with 100 to 4,999 staff, we estimate that between 1,750 and 3,440 make connected products, more than four fifths of them in Germany (Figure 2).^{37, 56, 175, 190, 367} Preparation for the CRA lags behind. Only 3 % of the surveyed German industrial firms consider themselves fully compliant.³³⁰

The population is small and concentrated. In Germany the 3,692 firms with 100 or more employees in electronics, electrical equipment, machinery and medical technology (WZ 26, 27, 28 and 32.5) make up about a third of the 11,359 legal units in these industries with 20 or more staff. Yet they employ 1.77 million of the 2.11 million people working there, or 84 %.³⁶⁷ The 100-249 band holds most firms but the lowest share of makers of connected products. Our estimate is least certain there, with a range of 673 to 1,692 German makers of connected products (Section A.3).^{37, 190, 367}

• Connected functions are standard in larger firms. The large majority of the 100 surveyed German industrial companies with products with digital elements (94 %) already offer updatable products.³³¹ Of 555 surveyed manufacturers with 100 or more employees, 45 % use IoT platforms and another 33 % plan to.³⁷
• Implementation depends on company size. Half of the surveyed firms have started active CRA implementation, 59 % of those with 500 or more employees and 37 % of the smaller ones. As many have no dedicated external reporting channel for vulnerabilities, although the reporting duty already applies.^{330, 331}
• Software bills of materials are mostly missing. Of 200 surveyed German industrial companies, 18 % have a software bill of materials (SBOM) for all affected products, 39 % have at least partially inventoried their software and 24 % have done nothing.³⁰⁷ Only 46 % are familiar with the CRA.³⁰⁷
• Awareness is low across the economy. Of 1,003 surveyed German companies with 10 or more employees, 29 % know what the CRA means for them.³⁶ More than a quarter (28 %) have never heard of it.³⁶