Skip to content Skip to sidebar Skip to footer

The Cyber Resilience Act for gambling operators and suppliers: what falls in scope and what has to be done

The Cyber Resilience Act reaches the gambling sector more widely than most operators assume. Downloadable casino and sportsbook clients, mobile applications, gaming cabinets, self-service betting terminals, kiosks and the software supplied with them all qualify as products with digital elements, and the guidance approved by the European Commission on 27 July 2026 removes much of the uncertainty as to where the perimeter runs.

Cyber Resilience Act guidance: which products, which obligations, from when

The European Commission approved on 27 July 2026 the content of its guidance on the Cyber Resilience Act, which is the most detailed interpretive document published to date on Regulation (EU) 2024/2847. It is formally non-binding, although it sets out the interpretation that market surveillance authorities, notifying authorities and notified bodies are expected to apply across the Union.