Regulation (EU) 2024/2847 is the EU’s first horizontal cybersecurity law for “products with digital elements” — hardware and software sold into the EU market with any kind of data connection. Think of it as a food nutrition label, but for software: every product needs a Software Bill of Materials (SBOM), a “list of ingredients” declaring every component and dependency inside it, kept current and available on request.
It entered into force in December 2024. Two dates matter for planning:
- 11 September 2026 — mandatory reporting of actively exploited vulnerabilities and severe incidents (24-hour early warning).
- 11 December 2027 — full application: CE marking, conformity assessment, SBOM obligations, secure-by-design documentation.
Miss it, and the fine ceiling is €15 million or 2.5% of global annual turnover — whichever is higher.
For a management audience, the simplest way to think about it: it’s a car’s roadworthiness inspection (MOT), applied to software. You don’t just build the car once and sell it — you’re now legally on the hook to keep proving it’s safe, for as long as you support it, and to prove you know exactly what’s under the hood.
Anyone from the community already worked on making your GCP infrastructure compliant to this regulation?
