After the fridge hacks: what changes for importers and brokers
How the Cyber Resilience Act and the new Union Customs Code change duties for importers and brokers from 2027
Hackers have tampered with blood storage refrigeration at three sites of France’s national blood service. Since October, attackers have taken over supermarket refrigeration in several European countries, spoiling stock. A connected product can now put public health at risk, not only a business. Under EU law, product cybersecurity is becoming a condition for market access. From 21 September 2027, importers and indirect customs representatives will answer to customs for it.
What does this mean for importers?
From 11 December 2027, each product with digital elements placed on the market must meet the Cyber Resilience Act, Regulation (EU) 2024/2847. The importer must ensure that the manufacturer has carried out the conformity assessment, and that the product bears the CE marking and comes with the EU declaration of conformity (Article 19). The new Union Customs Code also requires the importer to ensure that goods entering the Union comply with relevant ‘other legislation applied by the customs authorities’ (Article 27(2)(c) of Regulation (EU) 2026/2108).
Key dates
- 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe incidents, including for products already on the market.
- After 8 December 2026: Directive (EU) 2024/2853 on product liability applies. The importer can be liable where the manufacturer is established outside the Union.
- 21 September 2027: an indirect customs representative becomes jointly and severally responsible for the importer’s duties under Article 27(2). Where the importer is not established in the Union, the representative is considered the importer (Article 33).
What to do now
List your products that can connect to a device or network. Check whether radio equipment cybersecurity rules already apply. For each flow, establish who is the importer under the CRA and the Union Customs Code: the definitions differ. Customs representatives should review their use of indirect representation.
The full article covers:
- Which products are in scope, and which are excluded
- When customs release counts as placing on the market
- Every importer and distributor duty, and when an importer becomes the manufacturer
- What customs can check and how long release can be suspended
- A dated action list to December 2027
About this article
Based on Regulation (EU) 2024/2847, Regulation (EU) 2026/2108, Regulation (EU) 2019/1020, Directive (EU) 2024/2853 and the Commission’s Blue Guide 2022.The article reflects the law and the official sources as at 9 November 2026. Later changes are not covered until the article is updated.
Every article has an Article assistant for Pro and Team members. It answers your questions from the article and the sources it links to.
