Manufacturers Face New Compliance Demands Under EU Cyber Resilience Act

• •The EU Cyber Resilience Act mandates reporting of cybersecurity incidents for digital products.
• •Manufacturers must report vulnerabilities within 24 hours and severe incidents within 72 hours.
• •The act applies globally to products with digital elements, affecting various industries.

The EU Cyber Resilience Act (CRA) took effect on September 11, 2026, imposing mandatory cybersecurity reporting obligations on manufacturers of products with digital elements. These obligations include reporting actively exploited vulnerabilities and severe security incidents within strict timelines. Manufacturers must notify authorities of vulnerabilities within 24 hours, provide a fuller report within 72 hours, and submit a final report within 14 days of a corrective measure. The CRA applies to a wide range of products, including consumer IoT devices and industrial systems, regardless of the manufacturer's location. The act aims to enhance cybersecurity across the EU market, particularly for critical infrastructure sectors. Companies must prepare for compliance or risk facing regulatory penalties. The CRA's requirements are expected to significantly impact how manufacturers manage cybersecurity risks and incident reporting.