Summary
- ENISA says reporting duties may cover affected end-of-life connected products.
- The Act’s product vulnerability handling duties apply during specified support periods and to products within its scope.
- The clarification follows attacks on connected supermarket refrigeration controllers in France.
European cybersecurity authorities have clarified that some reporting duties under the EU Cyber Resilience Act can continue after connected products reach the end of manufacturer support, without creating an equivalent obligation to fix old vulnerabilities. The distinction emerged after cyberattacks affected internet-connected refrigeration controllers at French supermarkets, leaving retailers confronting failures in operational equipment.
The European Union Agency for Cybersecurity, ENISA, told Recorded Future News that reporting obligations under the Act also apply to products no longer sold in the EU but still in use. However, requirements to handle vulnerabilities and provide updates are linked to the product’s support period and other applicability conditions. This means a reportable event can involve equipment for which no new patch is legally required under those provisions.
The French incidents involved remote refrigeration management systems used by supermarket chains. France’s cyber authority, ANSSI, acknowledged compromises involving controller series associated with Danfoss and Copeland. Reporting described attacks that forced some refrigeration equipment into repeated or continuous defrost behaviour. The full extent of damage and the identity of the attackers were not established by the agencies in the available public statements.
Food refrigeration has a direct physical consequence when digital controls are manipulated. A compromised controller can change operating parameters rather than simply exposing information, potentially resulting in stock loss and service interruption. Technical isolation and restoration may therefore be complicated by the requirement to preserve food safety and verify that equipment settings are functioning as intended.
A reporting obligation is not a promise of a patch
The Cyber Resilience Act places obligations on certain products with digital elements, including cybersecurity requirements intended to be addressed throughout a defined support period. Its provisions have different commencement dates and transitional rules. Treating the Act as if every provision applied to every legacy device from one single date would misstate its reach, particularly where equipment was placed on the market years earlier.
ENISA’s explanation to The Record is narrower than a general exemption for old technology. It identifies continuing reporting responsibilities, while distinguishing those from the manufacturer’s separate duties for vulnerability handling. The agency did not confirm whether specific manufacturers had submitted reports concerning the French refrigeration events and did not disclose individual case notifications. An absence of public notification must not be treated as proof that a report was not filed.
Industrial and building control equipment often stays in service for long periods because replacement affects engineering compatibility, capital budgets, maintenance arrangements and ongoing operations. The length of a product’s working life may substantially exceed its manufacturer support window. That mismatch can leave owners responsible for managing operational risk when no supported update path remains, regardless of the strength of the surrounding regulatory regime.
The control systems implicated in the French incident were also internet reachable, introducing a separate exposure question from whether a manufacturer owed a new patch. An unsupported component behind properly restricted remote access does not face the same exposure as a directly reachable management interface. Conversely, the presence of a reporting rule does not reduce the technical risk on its own.
Cyber Insider has previously reported on insurance questions following the refrigeration attacks. The new ENISA clarification concerns regulatory accountability rather than insured loss: the affected organisation’s incident response, the manufacturer’s reporting obligations and any duty to correct the flaw must be assessed separately.
The position is particularly complicated for equipment bought before the Act’s principal product requirements become applicable. Some vendors may support devices voluntarily beyond what legislation requires; others may have ended update support long before an organisation plans to replace the controller. The regulatory clarification does not determine contractual responsibilities, national safety obligations or operational duties owed by a supermarket to maintain safe refrigeration. Those questions require separate examination of supply contracts and applicable national rules, rather than being inferred from the Cyber Resilience Act alone.
ANSSI said investigations were ongoing, while ENISA described cooperation through the EU network of computer security incident response teams. Their statements identify continuing oversight of the incident, but no general requirement that every unsupported controller involved must receive a manufacturer-issued fix.
