The European Union’s Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces mandatory cybersecurity requirements for products with digital elements, including connected heating, ventilation, air conditioning and refrigeration (HVAC/R) equipment.
Mandatory vulnerability and incident reporting requirements took effect on 11 September 2026, while the main cybersecurity obligations will apply from 11 December 2027.
Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and severe security incidents affecting products with digital elements.
HVAC/R manufacturers supplying the EU market have until 11 December 2027 to prepare for the main requirements.
Compliance preparations include reviewing connected product portfolios, assessing cybersecurity risks and establishing procedures for vulnerability management and software updates.