Cyber Resilience Act UK: Does It Apply? Essential Risk Guide
Does the EU Cyber Resilience Act apply to UK companies after Brexit? Yes — whenever software or hardware with digital elements is placed on the EU market, the duties follow the product regardless of where the manufacturer sits. This guide maps which UK businesses are caught and which escape, what placing on the market really means, the September 2026 reporting clocks and December 2027 full-application deadline, the manufacturer, importer and distributor duties, fines of up to 15 million euros or 2.5 percent of worldwide turnover, how the EU regime compares with the UK’s narrower PSTI rules and the services-focused Cyber Security and Resilience Bill, the unresolved Northern Ireland position under the Windsor Framework, and a four-step preparation plan for UK exporters.
