EU Cyber Resilience Act Reshapes Connected AV Hardware

A regulation that most AV buyers have not yet read is already changing how networked hardware is specified in Europe. The EU Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force in December 2024, and two of its milestones have already passed. Notified-body provisions applied from 11 June 2026, and, more consequentially, Article 14 reporting obligations have applied since 11 September 2026. From that date a manufacturer must report an actively exploited vulnerability to the coordinating CSIRT and to ENISA within 24 hours as an early warning, provide a fuller notification within 72 hours, and deliver a final report within 14 days of the fix. Importantly, the duty covers products already on the market, not only new shipments. Full application of the regulation begins on 11 December 2027.

Almost every modern AV device falls inside the scope, because the definition is deliberately broad: a product with digital elements that has a direct or indirect data connection, together with any remote data processing without which it cannot function. That covers networked matrices, AV-over-IP encoders and decoders, DSPs and audio interfaces, control processors and any room device that can be reached over the network. The essential requirements are risk-based but predictable: no known exploitable vulnerabilities at the moment of placing on the market, secure default settings, protection against unauthorised access, the ability to receive security updates, data and system integrity, attack-surface limitation, and a defined support period that is generally at least five years. Manufacturers must also identify and document components in a software bill of materials, handle vulnerabilities through the support period, and publish information about fixed flaws.

The teeth are in the link to CE marking. Failure to meet core cybersecurity obligations carries fines of up to 15 million euros or 2.5 per cent of worldwide annual turnover, whichever is higher, and a product that does not comply can lose its valid declaration of conformity, which removes it from the EU market altogether. Market surveillance authorities are expected to audit documentation and sample products, so vague or incomplete paperwork is itself a risk. There is also a practical trap in the sequencing: the duty to report came before the duty to search systematically, and a manufacturer can only report what it actually detects. That is why SBOM maintenance, continuous vulnerability matching and a tested reporting channel are becoming engineering projects rather than legal ones.

For integrators and consultants the buying criteria are changing accordingly. Tender documents now ask for a firmware lifecycle statement, a vulnerability reporting point of contact, evidence of a security update mechanism and, in some sectors, an SBOM on request. Amtune designs networked AV hardware with long-life firmware support, standards-based components and hardened defaults, and documents the security practice behind each range: AV-over-IP codecs and decoders, HD video seamless hybrid matrices, AV switchers and Dante and AES67 networked audio modules. Every product is manufactured under an ISO 9001 quality system and tested to CE, FCC and RoHS standards. Specification teams can request lifecycle and compliance documentation at sales@amtune.com.