The European Union’s Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces mandatory cybersecurity requirements for products with digital elements, including connected heating, ventilation, air conditioning and refrigeration (HVAC/R) equipment. Mandatory vulnerability and incident reporting requirements took effect on 11 September 2026, while the main cybersecurity obligations will apply from 11 December 2027.
The regulation covers hardware and software products capable of connecting directly or indirectly to other devices or networks. Potentially affected HVAC/R equipment includes smart thermostats, connected heat pumps, refrigeration controllers, remote monitoring devices, building automation and control systems (BACS), ventilation controllers and IoT gateways. Applicability depends on product characteristics, intended use and relevant legislative exclusions.
Manufacturers must integrate cybersecurity into product design, development, production and maintenance. Requirements include cybersecurity risk assessments, protection against unauthorised access, vulnerability management, security updates during the applicable support period and due diligence concerning third-party components. Manufacturers must also maintain software bill of materials (SBOM) documentation and complete applicable conformity assessment procedures for CE marking.
Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and severe security incidents affecting products with digital elements. An early warning must be submitted within 24 hours of awareness, followed by a more detailed notification within 72 hours and a final report within the applicable statutory deadline. Notifications are submitted through the Single Reporting Platform established by the European Union Agency for Cybersecurity (ENISA). These obligations can also apply to products already placed on the EU market.
The CRA entered into force on 10 December 2024, and provisions concerning notified conformity assessment bodies began applying on 11 June 2026. In July 2026, the European Ventilation Industry Association (EVIA) and other stakeholders announced guidance for manufacturers of Technical Building Systems (TBS) and BACS. The European Commission also published implementation guidance covering product scope, substantial modifications, support periods and reporting obligations.
HVAC/R manufacturers supplying the EU market have until 11 December 2027 to prepare for the main requirements. Compliance preparations include reviewing connected product portfolios, assessing cybersecurity risks and establishing procedures for vulnerability management and software updates. Equipment with long operational lifetimes may present additional challenges in maintaining cybersecurity support throughout the applicable period.
