Connected water coolers become regulated digital products on 11 September. Most POU operators have not noticed.

In 27 days, a water cooler that talks to the internet stops being catering equipment. It becomes a regulated digital product, with a 24-hour reporting clock attached.

The EU Cyber Resilience Act starts to bite on 11 September 2026. Makers of what the law calls "products with digital elements" must report security flaws that are being actively exploited, plus serious incidents. The first warning is due within 24 hours. A full notice follows within 72. The water dispense industry has spent two years selling connectivity as a feature. In three weeks it also becomes a duty.

What actually changes on 11 September

The Cyber Resilience Act is Regulation (EU) 2024/2847. Most of it applies from December 2027. The reporting part comes first, on 11 September this year.

Reports go through one platform run by ENISA, the EU's cyber agency. The report lands with the national response team where the company is based. That team then passes it to every other country where the product is sold. The European Commission confirmed on 31 July that the platform is in testing and will be live on the date.

One report now reaches every market you sell into, without you sending it.

Your machine is in scope if it talks to anything

The law covers products with a direct or indirect data connection. Lawyers reading the text agree that phrase is meant to be read widely. A connection can be physical or logical. A product can have several at once.

That catches a lot of modern dispense hardware. Screens that update over the air. Telemetry boxes reporting filter life. Payment modules. App-based dispensing. Fleet dashboards. Anything with a SIM card in it.

If a machine can be read or changed from somewhere other than the room it stands in, assume it is in scope.

The badge on the front decides who is liable

Here is the part most operators will miss. Under EU product law, the manufacturer is whoever's brand sits on the product. Buy a connected dispenser from a factory abroad, put your own logo on the fascia, and the law treats you as the manufacturer.

Rebadging is normal in this trade. Plenty of European operators sell an own-brand range built by someone else. Those operators have quietly taken on a software company's legal duties without hiring a single software person.

Nobody in dispense is built for a 24-hour clock

Ask a route-based operator what happens when a customer reports a leak. There is a process. A ticket, an engineer, a part, a visit, a sign-off.

Now ask what happens at six on a Friday evening when a supplier says a component inside 4,000 machines has a flaw that is already being exploited. Who decides it is reportable? Who files inside 24 hours? Who tells the customers?

Most operators have no answer, because until now nobody needed one.

The buyers will ask before the regulators do

This is the commercial half, and it is the more useful one.

Large employers already sit under their own cyber rules. Their facilities teams are being told to list every connected device on site. A dispenser with a SIM card belongs on that list, whether or not anyone has mentioned it to the water supplier.

We have watched this pattern run through filtration. A rule names a proof, buyers start asking for that proof in tenders, and the operators who can produce it take work from the ones who cannot. An operator who can hand over a named security contact, an update policy, a support end-date and a supplier chain they can describe will pass a screen that quietly removes rivals.

Bottled coolers sit outside this, and that is worth saying

A bottled water cooler with no connection is not a product with digital elements. No reporting duty. No update policy. No support window to promise and then honour for years.

That is a real advantage and it deserves plain acknowledgement. Simple machines carry fewer compliance surfaces. Sites with no mains, no drain, no signal or no permanent building are still served best by a bottled round, and a delivery driver in the building every fortnight remains a sales channel no screen has copied.

Every feature added to a machine is a feature somebody has to look after for its whole life. That is the trade, and it should be priced rather than assumed.

Where this goes next

Zenith tracks the installed base across more than 30 markets. Operators submit their data to us directly, and we add our own interviews and local data partnerships on top. The 2025 numbers show growth running to the machines that do more at the tap. Integrated tap systems grew by more than 12% in France, more than 11% in Germany and more than 15% in Spain. Those are the machines most likely to carry a screen, a board and a connection.

So the connected share of the European fleet is rising in exactly the year the rules arrive. December 2027 brings the heavier obligations: security by design, documentation, a declared support period. Three weeks from now is the moment operators find out whether the machine they badge is really theirs. The ones who answer that question early will spend the next two years selling against rivals who are still working out who is supposed to file the report.

P.S. Planning a product or market move while the rules are still being written? The 2026 Zenith Water Dispense Market Reports cover 30+ markets. That includes every West and East European country, plus Japan, Turkey, the UAE, South Korea and Mexico on request. Each one gives you the full BWD, POU and ITS model: operators and shares, B2C and B2B split, revenue and the 2019 to 2030 outlook. Excel, with the written report on request. Built on the world's largest water dispense database. https://waterdispenseinsights.com/reports