EU Cyber Resilience Act · For product manufacturers
The remote access gap that could block your CE marking
Get a free 20-minute Remote Access Component Review
The deadlines
Two dates decide your EU market access
11 September 2026
Manufacturers must now report exploited vulnerabilities to ENISA within 24 hours.
11 December 2027
Full CE marking compliance required. Penalties reach 15 million euros or 2.5% of global turnover.
The overlooked component
The remote access inside your product is in scope
If your machines include remote support, diagnostics, or monitoring, the tool delivering that capability is a digital component under the CRA. Your CE marking depends on its security evidence.
Most manufacturers we speak to have NEVER audited this component. The ones that have, find GAPS they did not expect.
Locate yourself
Four questions your compliance officer will ask
Whether you're exploring solutions for remote sites, secure environments, or simply want to ensure uninterrupted access when connectivity is limited, we’re on hand to help discuss your options.
Most engineering teams answer ‘NO’ to
AT LEAST THREE of these. The remediation work typically takes six to nine months.
Question 1:
Could we produce, within five working days, a complete security audit trail for the remote access tool inside our last shipped machine?
Question 2:
If a vulnerability was disclosed tomorrow, do we know who patches it, how fast, and how we document that to ENISA within 24 hours?
Question 3:
Is there a named commercial entity contractually responsible for that component, with a support commitment past 2030?
Question 4:
Have we documented whether any open-source components in our products have no clear vendor of record under the CRA?
The open-source gap
Open source isn't the problem.
Unowned open source is.
Open-source software can be entirely appropriate within a commercial product. The important question is whether someone has clear responsibility for monitoring, maintaining and supporting that component throughout the product lifecycle.
Do you know:
- exactly which implementation and version is deployed?
- whether it appears in the product SBOM?
- who monitors relevant vulnerabilities?
- who provides and validates fixes?
- how long the component will remain supported?
A 20-minute review. No slides, no pitch.
Bring the remote access setup inside one of your shipped products.
We'll tell you honestly where your CRA evidence stands and where the gaps are.
CRA readiness check
A clear read on whether your embedded remote access meets CRA conformity evidence requirements
Open-source exposure
Whether an open-source component leaves you exposed on the 24-hour reporting clock
Deadline gap analysis
The specific gaps to close before the December 2027 CE marking deadline
No sugarcoating
Straight answers. If RealVNC isn't the right fit, we'll say so
Length
20 minutes, remote
Run by
Embedded security lead, not sales
Cost
Free
Prep
None
4.7/5 on G2 · 250M+ downloads worldwide
The open-source gap
Request your CRA gap review
Not sure whether your remote access solution meets Cyber Resilience Act requirements? You're not alone. Many manufacturers already have vulnerability processes, software inventories and compliance programmes in place, but still discover gaps when remote access, third-party components and product support obligations are reviewed together. In a free 20-minute review, we'll assess your current approach, identify potential compliance gaps, and highlight the areas most likely to require attention before December 2027. No slides. No sales pitch. Just practical guidance from our security and remote access specialists.
Get In Touch
We'll only use your details to prepare your review.
What RealVNC Connect
helps you do
The remote access platform trusted by IT teams across manufacturing, healthcare, energy, and education.
ISO 27001
Certified
Increase uptime
Commercial support
Clear supplier relationship
Published disclosure
Coordinated vulnerability process
Independently audited
Third-party security review
Before you ask
Request your CRA
gap review
If you can’t find an answer to your question, please visit our Help Center or get in touch with us.
If you place products with digital elements on the EU market, yes. Even a small embedded remote access component counts as a digital element of the product.
Then this particular review isn’t for you. It’s specifically about remote access embedded in the products you ship and sell on. If you want to talk about internal IT remote access, that’s a different RealVNC conversation.
Nothing. It’s a 20-minute conversation, not a paid engagement.
No. It’s run by an engineer. If RealVNC isn’t the right answer for your situation, we’ll tell you.
The remediation work typically takes six to nine months, and the reporting obligation starts September 2026. Starting now is the difference between planning and scrambling.