October 22, 2026
For two decades, mini PC certifications meant the same three letters on a carton: CE, FCC, RoHS. They proved a device was electrically safe, spectrally polite and free of restricted substances, and once the test report was filed, the compliance work was finished. The EU Cyber Resilience Act ends that assumption. Regulation (EU) 2024/2847 entered into force on 10 December 2024, and it turns cybersecurity from a product attribute into a lifecycle obligation that follows the device for years after it ships — with reporting duties that already apply. Global mini PC revenue reached roughly USD 27.7 billion in 2025 and is projected to reach USD 44.5 billion by 2032, and a growing share of those units are networked, remotely managed and deployed in regulated environments. That is precisely the profile the CRA was written for.
The CRA applies in stages, and the first stage has already arrived.
Two details catch importers out. First, the reporting duty from September 2026 applies to in-scope products already placed on the market — it is not deferred until 2027. Second, penalties reach up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher, and the small-business relief is narrow: it concerns only the first 24-hour early-warning deadline, not the obligation itself.
The CRA covers any "product with digital elements" — hardware or software whose intended or reasonably foreseeable use involves a direct or indirect data connection to another device or network. A networked mini PC running a firmware stack, an operating system and, in most fleet deployments, an out-of-band management agent meets both conditions by design. Firmware, the operating system image and companion software are treated as one product.
Classification is risk-based. Most products sit in the default category and can be self-assessed by the manufacturer under Module A. Higher-risk classes require notified-body involvement or a European cybersecurity certification scheme. For importers, the classification question is not academic: it determines whether your supplier needs a third-party assessment before CE marking can be affixed, and therefore whether your delivery schedule has a notified-body queue in it.
The CRA allocates obligations by role, and the split matters for anyone buying from a factory outside the EU.
The practical read: if you import under your own brand, you inherit the manufacturer's obligations. Your ODM contract must therefore give you the artefacts those obligations require.
1. SBOM delivery and update cadence. A software bill of materials — including transitive dependencies — is mandatory technical documentation, and it must be versioned with each release. Write it in: deliverable format, delivery at each firmware release, and retention for the full support period.
2. Security update commitment with a response SLA. The CRA requires free security updates throughout the support period, at least five years for most products. Your contract should name the update responsibility (factory, OS vendor, or you), the target acknowledgement time for a reported vulnerability, and the patch delivery mechanism — signed, verifiable, and with an opt-out for automatic updates where required.
3. Support period and end-of-support notice. State the support period in years, the start date (first shipment, not firmware release), and a written end-of-support notification obligation with advance notice. The regulation also expects user notification of remedial measures, so the contract should specify who informs the installed base and how.
Add a fourth item worth its own clause: the vulnerability contact and disclosure policy. A published reporting route and coordinated disclosure process are explicit requirements, and a factory without one will not be able to feed your 24-hour clock.
Market surveillance runs on records. Before a shipment lands, the file should contain: the conformity assessment route and classification rationale; the manufacturer's cybersecurity risk assessment; design and architecture documentation; test evidence; the SBOM; the EU Declaration of Conformity; proof of CE marking; the secure update mechanism description; secure-boot and default-credential configuration; logging capability; and the data-deletion procedure required at end of life. None of this is a one-time deliverable — the CRA treats technical documentation as living documentation, current across the support period.
Layer this on top of the existing stack rather than replacing it: radio and EMC (RED), electrical safety, RoHS and REACH substance restrictions, energy-related product requirements, battery transport testing where cells ship separately, and WEEE or EPR registration in the destination country. The CRA is an additional cybersecurity layer, not a substitute.
Importers who start now will not be scrambling in late 2027. Inventory every model you place on the EU market and classify it. Map each model to its ODM and to whichever party brands it. Run a gap review of the evidence file above against what your supplier currently provides. Amend contracts to add the three clauses. Stand up an internal triage path that can reach a decision inside 24 hours, and connect it to whoever files to the CSIRT. Then set a quarterly review of field vulnerabilities feeding back into the SBOM and risk assessment.
Where hardware selection also influences this — secure boot support, TPM availability, signed firmware capability — raise it during platform selection, not after tooling. Our MX-APB03 high-performance mini PC, MX-ANP09 mini all-in-one PC and the wider Mini PC product catalog cover the configuration tiers most fleet buyers specify for managed deployments.
Yes, where the device has a direct or indirect data connection — which covers networked mini PCs, their firmware, operating system image and companion management software. Products are classified by risk; most fall into a default category assessed by the manufacturer, while higher-risk classes require a notified body.
Vulnerability and incident reporting obligations apply from 11 September 2026, including for in-scope products already on the market. The full essential requirements, conformity assessment, technical documentation and CE marking apply from 11 December 2027.
A software bill of materials lists every software component in the product, including transitive dependencies. The CRA requires it as part of technical documentation, versioned with each release, and it is what allows a vulnerability report to be triaged quickly enough to meet the 24-hour early-warning deadline.
Throughout the product's expected lifetime, and at least five years for most products. The support period must be defined, documented, and supported by free security updates, with users informed of risks and remedial measures.
Whoever markets the product under their own name or trademark carries the manufacturer's obligations. Private-label importers therefore need contractual access to the risk assessment, SBOM, update process and technical documentation from their ODM, not just a CE certificate.
Send your target markets, deployment profile and branding model — own brand or supplier brand — and our engineering and sourcing team will return a CRA readiness checklist for your configuration: classification rationale, SBOM and firmware-update commitments available in contract, the evidence file we can supply, and a costed quotation. Our engineering and sourcing team brings 10+ years of experience in electronics manufacturing.
Email: linda@liyuelec.com · WhatsApp / WeChat: linda4851 · www.liyuelec.com
Note: Liyu Electronic serves B2B clients only — distributors, brands, and corporate buyers. Minimum order quantities apply; we are unable to respond to individual, donation, or sponsorship requests.
About Liyu Electronic — Shenzhen Liyu Electronic Co., Ltd. (founded in 2019) is an OEM/ODM manufacturer of mini PCs, tablet PCs and laptops based in Shenzhen, China, with CE, FCC and RoHS certified products shipped to 40+ countries.
HOME
