EU Cyber Resilience Act Reporting Rules Now Enforced

• •Manufacturers must report cybersecurity incidents within strict deadlines.
• •The CRA aims to unify and strengthen cybersecurity regulations across the EU.
• •Broader obligations under the CRA will take effect by December 11, 2027.

As of September 11, 2026, manufacturers of connected hardware and software in the EU are required to report actively exploited vulnerabilities and serious security incidents under the Cyber Resilience Act (CRA). This legislation aims to enhance the cybersecurity of products with digital elements, responding to the increasing number of cyberattacks. Manufacturers must notify the European Union Agency for Cybersecurity (ENISA) and national Computer Security Incident Response Teams (CSIRTs) through a new Single Reporting Platform. Initial warnings must be submitted within 24 hours of awareness, followed by detailed notifications within 72 hours. The CRA introduces significant compliance obligations, transforming voluntary practices into enforceable duties. The broader cybersecurity requirements of the CRA will become fully applicable on December 11, 2027. This change marks a shift towards a more unified regulatory framework across EU member states, addressing previously fragmented cybersecurity requirements.