Moving production to the United States can shorten a supply chain. It does not shorten the list of responsibilities attached to a connected product sold internationally.
A reshoring decision should answer more than where a product will be assembled. For manufacturers of connected equipment, it should also answer who will maintain the software, investigate vulnerabilities, issue updates, and communicate with customers when something goes wrong.
September has made that distinction particularly important.
On September 11, 2026, reporting obligations under the European Union’s Cyber Resilience Act began applying to manufacturers of covered products with digital elements. The obligations address actively exploited vulnerabilities and severe incidents affecting product security. For U.S. manufacturers selling covered products into the European market, domestic production does not remove this responsibility.
The implication for reshoring is straightforward: bringing the production line home should trigger a review of the product’s entire support model.
The deadline is not the same for every obligation
The Cyber Resilience Act has a phased implementation schedule. Its main obligations apply from December 11, 2027, while the reporting requirements began on September 11, 2026. Manufacturers should not confuse the later date with permission to postpone work on reporting obligations already in force.
For reportable events, the European Commission describes an early warning within 24 hours of awareness and a fuller notification within 72 hours. Additional reporting follows, with different deadlines for exploited vulnerabilities and severe incidents. Notifications use the CRA Single Reporting Platform.
These are not simply document-retention requirements. Meeting a short reporting deadline requires a company to recognize an event, determine which products are affected, identify the appropriate decision-makers, and assemble information quickly.
Black Book’s recommendation is to test that process before a real incident makes the test unavoidable.
A shorter physical supply chain can still contain a long digital dependency chain
Consider a manufacturer transferring a connected industrial product from an overseas contractor to a U.S. facility. The enclosure, wiring, testing, and final assembly may move. The embedded operating system, communications module, third-party libraries, and remote-support arrangements may remain unchanged.
The factory has relocated. The manufacturer’s ability to understand and support the product may not have improved.
That distinction matters because the Commission’s manufacturer guidance addresses both finished products and components, including chips and operating systems. Its broader implementation framework encompasses risk assessment, technical documentation, conformity assessment, and vulnerability handling during the indicated support period. Those broader duties must be planned against their applicable implementation dates.
For a reshoring team, the practical question is not whether every software component must become American. It is whether the company has sufficient visibility, contractual rights, and operating capability to manage the product it sells.
Put product support into the transfer agreement
Before approving a production transfer, manufacturers should establish who controls the information needed to maintain each product version.
The transfer package should address access to current software and firmware records, responsibility for investigating reported vulnerabilities, availability of engineering support, update-testing procedures, and the means of identifying affected customers.
Supplier agreements deserve particular attention. A low-cost component may become an expensive dependency when its supplier cannot provide timely technical information or stops supporting a version still embedded in products in the field.
These are questions to resolve during supplier selection—not after the first cybersecurity notification arrives.
The same discipline belongs in the financial model. Black Book recommends separating the cost of manufacturing a connected product from the continuing cost of supporting it. A reshoring business case should explicitly budget for the product-security capabilities it expects to retain, acquire, or purchase.
September’s action is an operating exercise
A useful exercise is to take one covered product sold into Europe and work through a hypothetical supplier vulnerability notification.
Who receives it? Who determines whether the company’s version is affected? Who decides whether the event is reportable? Who prepares the notification? Who develops and distributes the corrective action?
The exercise should end with named owners and documented gaps, not a general assurance that the cybersecurity team is handling it.
Black Book’s position: domestic manufacturing and product accountability should advance together. A reshored product should not arrive with stronger physical control but the same unresolved digital dependencies.
Bringing production home is a location decision. Being able to stand behind the product is an operating capability.
