The EU Is Rewriting the Rules for Selling Products in Europe. Here Is What Businesses Need to Know
Any company that sells physical or digital products into the European Union is about to operate under a different set of rules. Between 2026 and 2027, several major regulations take effect, and together they change what compliance means for manufacturers, importers and distributors. Companies outside Europe are often the last to hear about these changes, and the first to be caught out by them.
The shift is broad. It touches product safety, cybersecurity, environmental documentation and legal liability. A product that was straightforward to sell in Europe two years ago may now carry obligations that did not exist when it was designed. Understanding what is coming is the first step to staying in the market.
Software Starts Carrying the CE Mark
For decades, the CE mark applied to physical products: machines, toys, electronics, medical devices. The Cyber Resilience Act changes that. For the first time, products with digital elements, including standalone software, will need to meet mandatory cybersecurity requirements before they can be sold in the EU.
The scope is deliberately wide. Any product that connects to a network or another device falls within it, from industrial controllers to consumer gadgets. Manufacturers must build security into the product from the design stage, maintain it throughout the product’s life, and report actively exploited vulnerabilities to European authorities within tight deadlines.
The first obligations arrive in September 2026, with full compliance required by December 2027. Companies that have never treated their products as cybersecurity assets now have to, and the penalties for ignoring this reach up to 15 million euros or 2.5 percent of global annual turnover.
Manufacturers Become Liable for Insecure Products
Alongside the cybersecurity rules, the EU has modernised its approach to product liability. The updated Product Liability Directive extends a manufacturer’s responsibility to cover damage caused by products that are unsafe because of how their software behaves or because they can be compromised.
This is a significant change in legal exposure. A defect is no longer limited to a physical fault. A product that causes harm because of a security weakness can now trigger liability, and that liability falls on the manufacturer regardless of where the company is based. Selling through a European distributor does not transfer the obligation.
For businesses used to thinking of liability in purely mechanical terms, this redefines what a defective product is.
Products Will Need a Digital Passport
The Ecodesign for Sustainable Products Regulation introduces the Digital Product Passport, a structured digital record that will accompany many products sold in Europe. It will hold information on materials, repairability, environmental footprint and compliance, accessible through a data carrier attached to the product.
The passport rolls out by product category over the coming years, starting with sectors such as batteries, textiles and electronics. For manufacturers, it means building and maintaining detailed product data in a format European systems can read, and keeping it accurate throughout the supply chain.
Companies that treat documentation as an afterthought will find this the hardest change to absorb, because it demands data discipline from the design stage onward.
Connected Machinery Faces New Requirements
The new Machinery Regulation replaces the old Machinery Directive and takes full effect in January 2027. It updates safety rules that had remained largely unchanged for years, and it brings machinery into the same conversation about digital risk.
The regulation adds explicit requirements around software, connectivity and the cybersecurity of safety-critical control systems. A connected machine now has to demonstrate that its digital components cannot be tampered with in ways that compromise safety. For manufacturers of industrial equipment, this closes the gap between mechanical safety and digital security.
The Real Challenge Is the Overlap
Each of these regulations is demanding on its own. The harder problem is that they apply at the same time, to the same products, through different legal instruments with different documentation and different deadlines.
A single connected industrial machine sold in Europe can fall under the Machinery Regulation for its safety, the Cyber Resilience Act for its digital security, the Product Liability Directive for its legal exposure, and the Ecodesign rules for its environmental record. Each framework asks for its own evidence, and none of them accepts the others as a substitute. Mapping a product across all of them, and identifying which obligations actually apply, is where many companies turn to specialist CE marking consultants rather than risk gaps that surface only when a shipment is stopped at the border.
The overlap also creates timing pressure. A company that prepares for one regulation in isolation may discover that satisfying it does nothing for the others, and that the effort has to be repeated four times over with different technical files.
What Businesses Should Do Now
The practical response is to start early and map exposure before the deadlines arrive. That means identifying which of these regulations touch each product, what evidence each one requires, and where the current documentation falls short.
The companies that will struggle are those that wait for enforcement to clarify their obligations. By the time a product is refused entry or a customer demands a Digital Product Passport, the timeline to comply has already closed. The regulations are published, the dates are set, and the requirements are known well enough to act on today.
Europe remains one of the largest and most attractive markets in the world. Access to it now comes with a heavier compliance burden, and the businesses that treat that burden as a design input rather than a last-minute obstacle are the ones that will keep selling there without interruption.
