TechnologyRegulation
Cyber Resilience Act: reporting duties for player makers already apply
Since 11 September 2026 manufacturers have had to report exploited vulnerabilities. What operators of screen networks should now ask their suppliers.
Regulation (EU) 2024/2847, known as the Cyber Resilience Act, entered into force on 10 December 2024. It requires manufacturers of connected products to meet a baseline of cybersecurity across planning, development and maintenance. It takes effect in two stages. Reporting obligations have applied since 11 September 2026; the remaining obligations apply from 11 December 2027. These dates are given on the European Commission's page on the regulation (accessed 3 October 2026).
For digital signage this is more than a footnote. A media player sits on the network, downloads content and is controlled remotely. Software installed on a customer's device is therefore among the products the regulation has in mind.
What has applied since September
If a vulnerability in a product is being actively exploited, the manufacturer has to report it. Germany's Federal Office for Information Security (BSI) lists three deadlines:
- an early warning within 24 hours,
- further details within 72 hours,
- a final report no later than 14 days after a fix is available.
Reports go through a central platform run by the EU agency ENISA, with the national response teams (CSIRTs) involved. A manufacturer with no place for such reports to arrive will struggle to meet the first deadline.
What follows in December 2027
From then on the requirements for the product itself apply. The Commission names vulnerability handling over the whole life cycle and the CE marking as the visible proof. According to the BSI, manufacturers must provide security updates for at least five years.
Five questions for your supplier
Screen operators are usually not manufacturers. They do carry the risk when a device in a shop window or a waiting room is taken over. These questions can be asked today:
- Where do I report a security flaw, and how quickly will I get an answer?
- Until what date will the version I am running receive security updates?
- How does an update reach the device: from the management software, or only with a technician on site?
- How can I tell that an installation file comes unchanged from the manufacturer?
- Which products have a declaration of conformity, and which version does it cover?
A manufacturer who answers these points in public saves customers the trouble of asking.
What a public answer can look like
Kapaso GmbH, the publisher of this magazine, keeps a page for this at kapaso.de/sicherheit. It gives a reporting address; according to the company, receipt is confirmed within three working days and a first assessment follows within ten. The same details are available in machine-readable form as security.txt.
A table lists, for each product, the version, the date until which security updates are promised, and the EU declaration of conformity. For the players and the management software those dates fall in 2031. Each installation file comes with a SHA-256 checksum; the Windows player also carries a Windows signature, and the Android app can be checked against the fingerprint of its certificate.
The page draws a line as well. Software that a provider runs exclusively as a service is not treated by Kapaso as a product within the meaning of the regulation. The same reporting address applies to those services.
What this means for planning
Anyone tendering for new screens in 2027 should write the support period into the tender. A player often runs longer than the contract it was bought under. For existing installations a simple list is enough: which device, which version, updates until when. The gaps in that list are where to start asking.
This article reflects the sources named above and is not legal advice.
