Whose product is it?

How we work

Why the allocation comes before the code

European product law has a long-standing logic that software is only now being brought into. The operator that places a product on the market under its own name is its manufacturer, whoever actually built it, and the manufacturer carries the obligations. The Cyber Resilience Act applies that logic to products with digital elements, software included, and the obligations it attaches are not formalities: conformity with essential cybersecurity requirements, conformity assessment and CE marking, an accurate inventory of components, a coordinated vulnerability disclosure policy, security updates throughout a support period that will in most cases run for at least five years, and a report to the competent authorities within twenty-four hours of learning that a vulnerability is being exploited.

The practical effect lands on businesses that do not think of themselves as software companies at all. A firm commissions an application, brands it, and supplies it to its own customers. On the Regulation's terms that firm is the manufacturer. It will be the one expected to hold a conformity file, to issue updates in five years' time, and to make a notification inside a day when something goes wrong at the weekend. Almost nobody in that position has been told, and the developer who built it is usually not the party on whom the duties fall. Writing the allocation down at the start costs very little. Discovering it afterwards costs a great deal, and arrives at the worst moment.

There is a boundary in all this that is genuinely unsettled, and pretending otherwise would be the wrong kind of confidence. Whether a bespoke deliverable supplied to one business is a product made available on the market is argued both ways, and the answer can depend on how it is supplied and what the recipient then does with it. So no general ruling is offered here. What is offered is a decision for your project, taken early, written down, with the support period scoped and priced and the reporting route named — and a referral to a lawyer when what you need is an opinion rather than an arrangement.