EU regulation setting cybersecurity requirements for hardware and software products sold in the EU. Covers secure-by-design rules, vulnerability handling and SBOMs, reporting exploited vulnerabilities from September 2026, and full obligations from December 2027.