EU Cyber Resilience Act: What China-Sourced Connected Products Should Check in 2026

The European Commission says the CRA entered into force on December 10, 2024, with the main obligations applying from December 11, 2027. Two earlier dates make the topic current in 2026: provisions on the notification of conformity assessment bodies apply from June 11, 2026, and reporting obligations for actively exploited vulnerabilities and severe incidents apply from September 11, 2026.

For China sourcing, the operational risk starts before those dates. Connected devices often move through a factory, trading company, app developer, firmware provider, cloud account, EU importer, and brand owner. If the buyer waits until goods are packed or already listed, it can be hard to confirm model identity, firmware version, CE evidence, support-period wording, user instructions, and the owner of vulnerability reporting.

The CRA applies to hardware and software products with digital elements made available on the EU market when their intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. That can include final products and separately marketed components.

For sourcing teams, the practical question is whether the product is merely an ordinary physical good or a connected product. A smart watch, baby monitor, camera, sensor, router, smart appliance, Bluetooth accessory, industrial controller, mobile app-connected device, or product with cloud-dependent functions needs a different evidence file than a passive product.

A connected-product evidence check should not stop at carton count and visible defects. The same hardware shell can ship with a different chipset, firmware build, app pairing method, cloud endpoint, default credential behavior, or support-period statement. Those differences can change the file the EU-side owner needs to review.

Before pickup, compare the buyer-approved record with the physical product and supplier files. The check should tie model number, hardware revision, firmware version, app version, product identifier, serial or batch details, labels, manual, insert, QR code, and packaging revision to the actual cartons being released.

The Commission summary explains that manufacturers need cybersecurity risk assessment, technical documentation, conformity assessment, EU declaration of conformity, CE marking, user information, and a support period. Importers and distributors also have verification and cooperation obligations before products are made available on the EU market.

A sourcing agent cannot validate a cybersecurity risk assessment, but it can check whether the files named by the EU owner match the goods. The visible evidence should not contradict the conformity story: manufacturer name, importer name, product identifier, CE label, manual, support-period statement, software version, and packaging should describe the same product.

From September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting products with digital elements. The Commission describes an early warning within 24 hours, a full notification within 72 hours, and later final reports. ENISA says the Single Reporting Platform will be used for mandatory reports from that date.

The reporting workflow is not a warehouse task, but the China-side file can make it easier to know who owns it. The buyer should know which manufacturer, brand owner, EU importer, distributor, open-source steward, cybersecurity team, or adviser will handle vulnerability intake, supplier escalation, update records, and authority communication.