Incident response and product lifecycle management emerged as the weakest capability areas, and medium-sized firms consistently scored higher than micro-enterprises. Over 70% of respondents said they needed practical support such as technical guidance and documentation templates, citing limited budget, staff and time as the main barriers to compliance. The first CRA reporting obligations begin on 11 September 2026.

Together with the Maturity Assessment Model, this survey gives retailers - many of whom act as importers or distributors of connected products - a clear, evidence-based picture of where the sector as a whole currently stands.

#CyberResilienceAct #DigitalSMEs #RetailSMEs #RetailCompetitiveness