Firm Wire items are announcements made by the firms themselves. The desk confirms that the announcement was published and reproduces its factual content. It does not verify the claims in it, and publication is not an endorsement.
Pinsent Masons says it reviewed security obligations in technology supply chains
Pinsent Masons said it published an analysis of how technology suppliers can align vendor contracts with new European security obligations. The firm said commitments made to customers and regulators may exceed existing subcontract protections, particularly under the Cyber Resilience Act, DORA and NIS2 frameworks.
Key points
- Pinsent Masons said Cyber Resilience Act incident and vulnerability reporting began September 11, 2026.Pinsent Masons
- The firm said the Act’s main security requirements apply from December 11, 2027.Pinsent Masons
- Pinsent Masons said manufacturers must generally handle vulnerabilities for at least five years, even if a component vendor stops support.Pinsent Masons
- The firm said suppliers should document contractual gaps, alternative controls and who accepted remaining risks.Pinsent Masons