"The AI did it" won't save you when EU regulators come knocking

The EU Cyber Resilience Act will impose strict security rules on products with digital elements, including software built with AI coding tools.

Vendors must report actively exploited vulnerabilities within 24 hours, provide security updates for the supported lifetime, and meet full compliance by December 2027.

The analysis says AI-generated code does not shift responsibility: manufacturers remain accountable for shipped vulnerabilities and CE-mark compliance.

EU companies and vendors selling to EU customers should prepare now, with reporting obligations starting in 2026 and fines for violations.