Cyber ​​Resilience Act: New rules for connected HVAC/R products

The digitalization of HVAC/R systems brings with it new management, monitoring, and maintenance opportunities, but also growing exposure to cyber risks. Supervisors, refrigeration controllers, connected heat pumps, BACS systems, remote monitoring devices, and IoT gateways are increasingly becoming part of complex digital ecosystems.

Precisely for this reason, the Cyber ​​Resilience Act (CRA), Regulation (EU) 2024/2847 , introduces mandatory cybersecurity requirements for products with digital elements placed on the European market. Reporting obligations for actively exploited vulnerabilities and serious incidents have already come into force since September 11, 2026 , while the main requirements of the regulation will become applicable from December 11, 2027 .

For the refrigeration and air conditioning sector, the change is significant: cybersecurity must no longer be considered just as an additional measure, but as a requirement to be integrated into product design, development, and maintenance .

Integrated cybersecurity by design

One of the central principles of the Cyber ​​Resilience Act is that security must be built into the product from the earliest stages of its development.

Products with digital elements must be designed to ensure a level of cybersecurity appropriate to the risk and, where applicable, be placed on the market without known exploitable vulnerabilities and with secure default configurations.

For the HVAC/R sector, this approach can concern numerous connected devices, including:

• refrigeration system controllers;
• supervision systems;
• connected heat pumps;
• ventilation and air conditioning controllers;
• BACS systems;
• remote monitoring devices;
• IoT gateways and components.

The actual applicability of the regulation will, however, depend on the characteristics of the product, its use, and any exclusions provided for by the legislation.

For manufacturers, this means assessing cyber risk across the entire product lifecycle , considering not only hardware but also software, firmware, network communications, and third-party digital components.

Vulnerabilities, updates and support become part of compliance

The Cyber ​​Resilience Act also introduces new requirements related to vulnerability management.

Manufacturers will need to establish procedures to identify and correct any critical issues, ensuring security updates are provided during the expected support period . Third-party software components will also need to be considered in the risk assessment.

A particularly important aspect for the HVAC/R sector concerns the long operational life of the equipment. A refrigeration system, a supervisor, or a building automation system can remain operational for many years, while software components and communication protocols can become vulnerable much more quickly.

For this reason, security management cannot end at the point of sale. Updates, software maintenance, and vulnerability monitoring will become an integral part of the relationship between manufacturer, installer, maintainer, and end user .

The regulation also links these requirements to conformity assessment procedures and CE marking , making cybersecurity an increasingly integrated element of overall product compliance.

Reporting vulnerabilities and serious incidents will be mandatory from 2026

Part of the regulation is already operational.

From September 11, 2026, manufacturers must report actively exploited vulnerabilities and serious security incidents affecting their digital products.

The system includes:

• an initial report within 24 hours of becoming aware of the event;
• a more complete notification within 72 hours ;
• a final report within the deadlines set by the regulation.

Communications are managed through a single European reporting platform. These obligations may also apply to products already on the European Union market.

It is therefore necessary for HVAC/R manufacturers to establish internal procedures capable of rapidly collecting reports from the market, assessing their severity, and activating any corrective measures.

For the HVAC/R supply chain, the very concept of maintenance is changing

The gradual entry into force of the Cyber ​​Resilience Act confirms a transformation already underway: a connected HVAC/R product can no longer be considered only from a mechanical, refrigeration or electrical point of view .

System security increasingly depends on updated firmware, access authentication, vulnerability management, and communications protection.

For manufacturers, system integrators, and maintenance technicians, this means gradually expanding their skills and operational procedures. Maintaining connected systems must therefore also consider aspects such as software updates, credential management, configuration verification, and device compatibility.

The main deadline remains December 11, 2027 , when the key CRA requirements will come into force.

For the HVAC/R sector, this will be a significant shift: cybersecurity will increasingly become part of product quality, safety, and compliance , with implications not only for manufacturers but also for the entire design, installation, and service chain.