Online Casino Mobile Apps and the Cyber Resilience Act: What Changes in 2026 According to DLA Piper
Cybersecurity requirements for online casino mobile apps are becoming more important in the European Union as the Cyber Resilience Act, Regulation (EU) 2024/2847, moves through its implementation timetable. The regulation entered into force on 10 December 2024, but its obligations do not all begin at the same time. For casino businesses, 2026 is particularly important because mandatory reporting of certain cybersecurity events started on 11 September 2026, while the wider product-security requirements will apply fully from 11 December 2027. An August 2026 analysis by DLA Piper specifically examined gambling products and confirmed that downloadable casino applications can fall within the CRA as products with digital elements. This makes the regulation relevant not only to software developers but also to gambling operators that distribute mobile apps under their own name.
Why Online Casino Mobile Apps Fall Within the Cyber Resilience Act
The Cyber Resilience Act establishes common cybersecurity requirements for hardware and software made available on the EU market. Its central concept is the “product with digital elements”, which broadly covers software or hardware whose intended or reasonably foreseeable use involves a direct or indirect connection to a device or network. A mobile casino application normally meets this description because it is installed on a connected device and communicates with remote systems to authenticate the user, load account information, provide games and process gambling-related actions. The fact that the software may be downloaded at no additional charge does not automatically place it outside the rules when it is supplied as part of a commercial activity.
DLA Piper’s gambling-sector analysis published on 18 August 2026 treats a mobile application distributed through an app store as falling within the CRA. It also draws an important distinction between an installed application and a casino accessed solely through a web browser. Browser-only access does not, by itself, mean that the operator has made a software product with digital elements available on the market. A native casino app installed on a player’s smartphone is different because the operator or supplier is distributing software that operates on the user’s device. This distinction means that two casinos offering broadly similar services may face different CRA questions depending on how users access those services.
Operators also need to consider each version of an app rather than treating every release as one undifferentiated product. DLA Piper notes that builds with different components or enabled functions, including versions developed for separate operating systems or specific national markets, can require their own assessment. An iOS application and an Android application may share most of their design, but differences in software components, permissions, payment functions or security controls can matter. Companies therefore need a clear record of which builds they distribute, which components each build contains and who is responsible for maintaining them. This does not necessarily require a separate compliance process for every minor update, but the distinctions must be understood and documented.
What the 2026 CRA Timeline Actually Means for Casino Apps
The CRA timetable is important because it would be inaccurate to describe all of its cybersecurity requirements as already mandatory in 2026. The regulation entered into force in December 2024. Provisions concerning the notification of conformity assessment bodies began applying on 11 June 2026, and the European Commission published further CRA guidance on 27 July 2026. The next major date was 11 September 2026, when the reporting obligations in Article 14 became applicable. The regulation will then apply in full from 11 December 2027. Casino businesses therefore need to distinguish obligations that are already legally active from requirements for which preparation is currently under way.
As of September 2026, manufacturers must already report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. Importantly, this reporting requirement is not limited to software first released after September 2026. The European Commission states that the reporting rules apply to products with digital elements that have already been made available on the Union market. An existing casino application can therefore fall within the reporting regime even though the broader CRA product-conformity rules are still moving towards their December 2027 application date.
The transitional position is different for the wider product requirements. Products placed on the market before 11 December 2027 are generally brought within the broader CRA requirements after that date if they undergo a substantial modification. Whether an app change amounts to such a modification depends on its effect on the product and its cybersecurity risk rather than simply on whether a new version number has been issued. For casino operators, this makes 2026 a preparation year as well as an active reporting year. Existing incident procedures need to work now, while app development, documentation and supplier arrangements need to be reviewed in advance of the fuller compliance regime.
Security Requirements Casino App Businesses Need to Prepare For
The wider CRA requirements are designed around the principle that cybersecurity should be considered when a product is designed and developed rather than added only after a problem appears. Once the main provisions apply, manufacturers will need to ensure that products are designed, developed and produced in line with the essential cybersecurity requirements in the regulation. In practical terms, a casino mobile app should not be released with known exploitable vulnerabilities, unnecessary exposure should be reduced, access to sensitive functions should be controlled and information should be protected against unauthorised access or alteration. The precise measures will depend on the risks of the individual app rather than on one fixed technical checklist.
A documented cybersecurity risk assessment is central to this process. The CRA requires manufacturers to consider cybersecurity risks during planning, design, development, production, delivery and maintenance. For a casino app, that assessment can cover areas such as player authentication, account access, communication between the app and remote systems, handling of payment-related information, integration of games and the use of external software components. The aim is not to create documentation for its own sake. The assessment should show which risks were identified, what was done about them and why the selected safeguards are appropriate for the functions that the application performs.
Vulnerability handling continues after an app has been released. Manufacturers are expected to deal with vulnerabilities throughout the stated support period and provide the security updates necessary to address them. The CRA generally sets a support period of at least five years, unless the product is reasonably expected to be used for less than five years. Software developed through frequent releases receives specific treatment: in certain circumstances, remediation can focus on the latest version if users of earlier versions can upgrade without additional cost. For casino operators, the practical issue is therefore not only how quickly a new app can be launched, but also how long its security can realistically be maintained and how users will receive necessary fixes.
Back-End Systems, External Suppliers and Responsibility for Security
A mobile casino app rarely works in isolation. Authentication, account balances, game sessions and other functions may depend on software running remotely. Under the CRA, some remote processing can be treated as part of the product when it is necessary for the app to perform its functions and has been designed or developed by the manufacturer, or under the manufacturer’s responsibility. DLA Piper gives the example of a back end developed by an operator without which a gambling app cannot authenticate a player or place a bet. In such a situation, looking only at the software installed on the phone would provide an incomplete picture of the product’s cybersecurity risks.
External services require a different assessment. A third-party identity-checking service, customer support tool, analytics service or remote game server is not automatically treated in the same way as software developed by the operator itself. DLA Piper notes that a remote game server operated by a separate gambling supplier will normally need to be considered as a third-party component or dependency where the casino operator did not design or develop it. The operator still needs to understand the risks created by the connection. Sensible controls can include reliable authentication between systems, checks that exchanged information has not been altered and procedures that prevent the mobile app from behaving insecurely if an external service becomes unavailable.
Contractual arrangements with suppliers consequently become part of practical CRA preparation. A casino operator needs to know who will investigate a vulnerability, who supplies a patch, how quickly security information will be communicated and what evidence can be provided for the operator’s own risk assessment. This is especially relevant where an operator distributes an app under its own brand. DLA Piper’s 2026 analysis states that an operator distributing an application under its own brand and gambling licence may be treated as its manufacturer even where another company performed the development work. Existing gambling certification does not automatically replace CRA obligations either, because gambling technical approval and EU cybersecurity conformity address different regulatory requirements.
Incident Reporting Requirements Already Relevant in 2026
The most immediate CRA change for casino mobile apps in 2026 is Article 14 reporting. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements. The first warning must normally be submitted within 24 hours after the manufacturer becomes aware of the event. Additional information follows within 72 hours. For an actively exploited vulnerability, a final report is required no later than 14 days after a corrective or mitigating measure becomes available. For a severe security incident, the final report is due within one month of the 72-hour notification.
These deadlines make internal escalation especially important. The reporting clock is linked to awareness, so a casino business cannot rely on a lengthy internal process before deciding whether an event reaches the CRA threshold. DLA Piper explains awareness as the point at which, following a prompt initial assessment, the manufacturer has a reasonable degree of certainty that a vulnerability in its product is being actively exploited or that a severe incident has compromised the product’s security. Security staff therefore need a clear way to escalate relevant findings to the people responsible for regulatory decisions, while legal teams need enough technical information to decide whether notification is required.
CRA reporting may also exist alongside other legal duties. A security event involving a casino app could involve personal information and therefore require a separate assessment under the GDPR. National gambling licence conditions may create their own incident-reporting duties, while NIS2 requirements can apply to organisations that fall within its scope. These regimes do not use identical definitions, thresholds or deadlines. A single event should therefore be reviewed against each applicable set of rules rather than assuming that one notification satisfies every obligation. DLA Piper specifically highlights this overlap as a practical concern for gambling businesses.
What Casino App Teams Should Do Before Full CRA Application
The first practical task is to establish an accurate inventory of software supplied to users. For a casino business, that means identifying current and legacy mobile applications, separate iOS and Android builds, market-specific versions and any downloadable desktop software that may also qualify as a product with digital elements. Each product should be connected to a responsible legal entity, development team and supplier chain. The same review should record which remote services are essential to the app’s operation and which are independent external components. Without this information, it becomes difficult to assess vulnerabilities or determine who must respond when an incident occurs.
The second priority in 2026 is a working CRA incident procedure. Staff should know how a possible actively exploited vulnerability or severe incident is reported internally, who performs the initial assessment, who authorises regulatory notification and who collects the information needed for the 24-hour and 72-hour stages. Relevant personnel also need access to the ENISA reporting system used for CRA notifications. Decisions should be recorded, including situations where an incident has been reviewed and found not to meet the CRA threshold. This creates a clearer record of how the company applies the regulation and reduces the risk of losing valuable time during a serious event.
The third priority is preparation for the wider requirements that become fully applicable on 11 December 2027. Casino operators and suppliers can use 2026 to review cybersecurity risk assessments, vulnerability-handling processes, app support periods, software-component records, supplier contracts and release procedures. Teams should also identify where responsibility changes when software is substantially customised or distributed under a different brand. The key distinction is timing: September 2026 introduced an active legal reporting duty, while many design, documentation and conformity requirements remain part of the preparation for 2027. Treating those two stages separately allows casino businesses to address what is mandatory now without losing sight of the larger compliance work that follows.
