Will your connected products still be sellable in Europe in 2028?
The Cyber Resilience Act sets new security requirements for every connected product sold in the European Union. MCDev brings the software side of your products into compliance: mobile apps, firmware updates and the platforms behind them.
A legal obligation with fixed deadlines
The Cyber Resilience Act (EU Regulation 2024/2847) applies to every product with digital elements placed on the EU market: connected devices, software, firmware, and the online platforms they need to work. Swiss manufacturers exporting to the EU are directly affected.
Three dates to remember:
- 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe incidents. Early warning within 24 hours, notification within 72 hours.
- 11 December 2027: only compliant products bearing the CE marking may be placed on the EU market.
- For at least 5 years: manufacturers must provide security updates for their products free of charge.
Switzerland is also preparing legislation on the cyber resilience of digital products, aligned with EU law.
What we find most often
In products that combine a device, a mobile app and a server, the same issues keep coming back:
- Unauthenticated Bluetooth: any nearby phone can read or change the device configuration.
- Secret keys embedded in the app, identical across the whole fleet and extractable in minutes.
- Unsigned firmware updates: the device accepts modified software or a rollback to a vulnerable version.
- An invisible fleet: the manufacturer does not know which versions run in the field, so it cannot tell who is exposed when a flaw appears.
- No list of the software components used (SBOM), so no alert when a dependency becomes vulnerable.
- No vulnerability reporting process, while legal deadlines are counted in hours.
A three-step approach
1. Assessment
We review your product's software chain: iOS and Android app, device communication, firmware update mechanism, server and dependencies. You receive a clear report: what complies, what does not, and a prioritised action plan.
2. Remediation
We implement the fixes: authenticated pairing, authorisations verified by the device, signed updates with rollback protection, fleet version tracking, automated SBOM generation, vulnerability monitoring and a reporting process. We provide the technical documentation needed for your conformity file.
3. Security maintenance
We monitor vulnerabilities, ship fixes and publish updates for the full support period required by the regulation, as a subscription.
We build this kind of product
Hands-on experience
We have designed and shipped iOS and Android apps that control industrial equipment over Bluetooth, with remote firmware updates, offline operation and full action traceability.
The whole chain
Mobile apps, backend, infrastructure and DevOps within one team.
Swiss hosting
We favour Swiss-hosted solutions and tools free of single-vendor lock-in.
A local partner
Based in Savièse, Valais, we work with manufacturers across Switzerland.
MCDev carries out the technical compliance work. For products that require a third-party assessment, we work alongside your legal and certification partners.
Frequently asked questions
My company is Swiss. Does this apply to me?
Yes, as soon as you sell connected products in the European Union. The regulation applies to every product placed on the EU market, wherever the manufacturer is based.
Do products already on the market need to change?
Products placed on the market before 11 December 2027 are not retroactively subject to every requirement. However, the obligation to report actively exploited vulnerabilities already applies, and a substantial modification of an existing product can bring it into scope.
Is my app in scope, or only the device?
The regulation covers the product as a whole: the device, its firmware, and the software and platforms it needs to work. The companion app and the update chain are therefore central.
Do you issue a certification?
No. For most products, the manufacturer carries out the conformity assessment itself. Our role is to make the software side compliant and provide the technical material for your file.
How long does it take?
The assessment takes a few days. Remediation time depends on the state of your product. Given the December 2027 deadline and hardware development cycles, it is best to start now.
Let's review your product
A first 30-minute call, with no commitment, to assess your situation and priorities before December 2027.