Oracle Aligns Security Programs with EU Cyber Resilience Act Requirements

• •The EU Cyber Resilience Act's reporting obligations began on September 11, 2026.
• •Oracle has established policies to comply with the CRA's incident reporting requirements.
• •Manufacturers must report actively exploited vulnerabilities within 24 hours.

The EU Cyber Resilience Act (CRA) mandates vulnerability and incident reporting for manufacturers of digital products, effective September 11, 2026. Oracle has prepared its Security Incident Management Policy and Integrated Cyber Center to meet these requirements. The CRA's initial reporting obligations focus on actively exploited vulnerabilities and severe incidents, with a 24-hour reporting deadline. Following this, broader cybersecurity obligations will take effect on December 11, 2027. Oracle's compliance efforts include documenting incidents, preserving evidence, and notifying relevant parties. However, customers with NIS2 or DORA obligations must still provide their own compliance evidence. The CRA applies to all connected products, including those already on the market, but manufacturers are not required to report incidents they were aware of before the September deadline. The reporting must be done through the EU's Single Reporting Platform, with notifications sent to the relevant Computer Security Incident Response Team (CSIRT).