Stonetusker Insights · Technical note on embedded devices and European Union rules
European Union Dates for Device Makers, 2026 to 2027: One Table and a 30-Minute Check
Five dates between April 2026 and December 2027 touch teams that ship firmware or connected devices into the European Union. Three have already passed. This note puts them in one table, with one check for each date.
For: Teams that ship firmware or connected devices into the European Union
Skip if: You sell no hardware, firmware or connected products in the European Union.
Technical and engineering guidance. Please confirm legal obligations with your own counsel.
The short version
- Since 11 September 2026, the Cyber Resilience Act reporting duty covers actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours of becoming aware.1
- From 12 September 2026, the Data Act rule on access by design covers connected products placed on the market after that date.3,4
- The Machinery Regulation applies from 20 January 2027, and the main Cyber Resilience Act obligations apply from 11 December 2027.5,2
- Each row below has one check that takes about 30 minutes. Which rule reaches which product is a question for your counsel.
Why it matters now
Three of these dates are already in the past. Devices keep running after such a date, so the effect shows up later, in a customer security review, an audit or a vulnerability report.
Most of the checks below come down to records: which software is in which release, and who decides. The table gives each date one check that a team can run in about 30 minutes.
The calendar
| Date | Rule | Who it reaches | 30-minute check |
|---|---|---|---|
| April 2026 (passed) | Yocto Project 4.0 Kirkstone reached end of support.7 Details: Cyber Resilience Act reporting and Yocto Kirkstone. | Embedded Linux products built on Kirkstone, often through a chip vendor board support package | Run grep -r --include=layer.conf LAYERSERIES_CORENAMES . in the build tree of each shipping product. |
| 11 September 2026 (passed) | Cyber Resilience Act reporting: actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours and a full notification within 72 hours.1 Details: Cyber Resilience Act reporting and Yocto Kirkstone. | Manufacturers of products with digital elements, including products already on the market | Pick one shipped firmware release and list its components and versions from stored records. Time it. |
| 12 September 2026 (passed) | Data Act (Regulation (EU) 2023/2854), Article 3(1): connected products and related services are designed so that the data they generate is, by default and where relevant and technically feasible, directly accessible to the user, in a machine-readable format.3 Details: European Commission: Data Act explained. | Connected products and related services placed on the market after 12 September 2026. Micro and small enterprises are exempt from the data sharing chapter under conditions in Article 7, which also has a limited rule for some medium-sized enterprises.4 | On one product, try to export the data it generates as a user would, without help from support. Note what is missing. |
| 20 January 2027 | Machinery Regulation (EU) 2023/1230 applies. Its definition of a safety component includes software, and Annex III section 1.1.9 covers protection against corruption.5,6 Details: European Commission: Machinery. | Machinery and related products placed on the market from 20 January 2027. Machinery placed on the market before that date must comply with Directive 2006/42/EC.5 | For one machine, list the software it needs to operate safely, and write down how you would detect a change to it. |
| 11 December 2027 | Main Cyber Resilience Act obligations apply.2 Details: Cyber Resilience Act reporting and Yocto Kirkstone. | Manufacturers of products with digital elements | Check whether each product line has a written support period with an end date. |
Five questions to ask your team
- Can we name every product we sell in the European Union and the firmware version each one runs today?
- Do we have a stored software bill of materials for every shipped release?
- Has one person been named to decide on a 24-hour early warning?
- Do we know which products still build on Yocto Kirkstone or older?
- Has our counsel told us in writing which of these rules reach each product line?
What is still open
- The Cyber Resilience Act does not apply to products covered by the European Union regulations on medical devices (2017/745), in vitro diagnostic medical devices (2017/746) and vehicle type approval (2019/2144). It also excludes products certified under the aviation safety regulation (2018/1139) and marine equipment (Directive 2014/90/EU). These products have their own sectoral rules.2,8,9
- The Data Act exemption for micro and small enterprises depends on partner and linked enterprises and on subcontracting.4 Counsel should read it against your company structure.
- Whether a product counts as a connected product, as machinery or as a product with digital elements depends on legal definitions. This table does not answer that.
A note to forward to your team
European Union dates for our devices
Five dates between April 2026 and December 2027 touch our firmware and connected products. Three have passed.
Please run the checks in this note by [date] and reply with four counts:
1. Product lines we sell in the European Union
2. Product lines that build on Yocto Kirkstone or older
3. Shipped releases with a stored software bill of materials
4. Connected products where a user can export the device data without our help
Owner: [name]
Note: https://stonetusker.com/insights/embedded-eu-calendar-2026-2027.htmlWant a second opinion?
Run the checks yourself first. If you would like a second opinion, reply with three counts only: the product lines you sell in the European Union, the product lines on Yocto Kirkstone or older and the shipped releases with a stored software bill of materials. No product names, files or build output are needed. Within five working days you receive a short written note with an order of engineering work for the dates in this table. It is free and confidential, and a call is optional.
The button opens an email to subeesh@stonetusker.com with the subject and the numbers to fill in. You can also use the contact page, or reply to the email or LinkedIn message that brought you here.
Next page for your situation
- Cyber Resilience Act reporting and Yocto Kirkstone: the 24-hour reporting check and the path off Kirkstone, step by step.
- The 2026 minimum elements for a software bill of materials: one query shows how complete the release records behind these checks are.
Sources
- European Commission: Cyber Resilience Act reporting obligations
- European Commission: Cyber Resilience Act
- European Commission: Entry into force or application of EU legislation, key milestones, 1 September to 15 October 2026
- Belgian Institute for Postal Services and Telecommunications: Data Act, rules specific to SMEs
- European Commission: Machinery
- EUR-Lex: Regulation (EU) 2023/1230 on machinery
- Yocto Project: Releases
- Kirkland and Ellis: The EU Cyber Resilience Act (September 2026)
- Cyber Resilience Act, Article 2 (scope)
About the author
Subeesh Sivanandan is the Founder and CEO of Stonetusker Systems. He has worked for more than 27 years in release engineering, DevOps, platform engineering & embedded Linux. His career includes serving as the Principal Engineer & Manager of Release Engineering at Stryker, alongside earlier roles at Nokia, VeriSign, and IP Infusion. LinkedIn profile.
Revision history (recent 3 updates)
Version 1.0, 29 October 2026. Every fact on this page is checked against a minimum of two sources each month.
| Version | Date | Change |
|---|---|---|
| 1.0 | 29 October 2026 | First edition |