Obligations of Manufacturers — Product Security by Design

Article 10 establishes that manufacturers must:

1. Ensure Annex I compliance — Design and produce products that meet all essential security requirements in Annex I Part I (product properties) and Part II (vulnerability handling).
2. Conduct security risk assessment — Perform and document a cybersecurity risk assessment before placing a product on the market.
3. Maintain technical documentation — Compile and keep the technical file required for conformity assessment (Article 23 + Annex V).
4. Apply CE marking — Affix the CE marking to compliant products and issue a declaration of conformity.
5. Provide security updates — Ensure products can receive security updates for their supported life.
6. Notify incidents — Report actively exploited vulnerabilities to ENISA per Article 14.

Before placing a product on the market, manufacturers must conduct a cybersecurity risk assessment that:

• Identifies the intended purpose and foreseeable misuse of the product
• Analyses the threat landscape for the product category
• Assesses the cybersecurity risks to users
• Documents the security controls implemented to address those risks
• Is updated when the product is substantially modified

This risk assessment forms the core of the technical documentation and is reviewed by notified bodies for Annex III products. For self-assessed Default class products, it is the primary evidence of due diligence.

Article 10(6) requires manufacturers to identify and document components in their products, including a software bill of materials (SBOM) at minimum covering the top-level dependencies.

• Tracking of known vulnerabilities in third-party components
• Compliance with the 'no known vulnerabilities' requirement in Annex I
• Supply chain security transparency

The SBOM does not need to be publicly available (unlike security advisories), but must be producible quickly for regulatory inspection.

Article 10 is not just about pre-market design. It establishes ongoing post-market obligations:

• Vulnerability monitoring: Continuously monitor for new vulnerabilities affecting your products and their components.
• Remediation without undue delay: When a vulnerability is confirmed, act promptly to develop a fix or workaround.
• Update distribution: Ensure security updates reach users — this may require push notification mechanisms for connected products.
• End-of-life notification: Inform users when security support for a product ends.
• Records maintenance: Keep records of vulnerabilities, investigations, and remediations for 10 years.