How does the Cyber Resilience Act affect small businesses?

For small manufacturers the binding cost is usually the support period: maintaining an update capability, dependency monitoring and release engineering for years after shipping. That is a resourcing decision, not a documentation one.

Commercial pressure often arrives before the legal deadline, because integrators need supplier SBOMs, support commitments and conformity evidence to support their own claims.