🔒Cyber Resilience Act Reporting Rules Go Live in EU
EU's New Cyber Reporting Rules Are Here
TL;DR
The Cyber Resilience Act's mandatory reporting rules for EU digital products took effect on September 11, 2026. Manufacturers must now report vulnerabilities and security incidents within strict deadlines. Fines for non-compliance can reach €15 million.
The Cyber Resilience Act's mandatory reporting rules for EU digital products took effect on September 11, 2026. Manufacturers must report vulnerabilities and security incidents within 24 hours and provide final reports within 14 days. Non-compliance can lead to fines up to €15 million or 2.5% of annual turnover. This impacts all manufacturers, EU-based or not, and requires a comprehensive understanding of software supply chains. The act aims to improve cyber resilience and reduce serious cyberattacks across the EU.
Key Points
Manufacturers must report actively exploited vulnerabilities within 24 hours of awareness, September 11, 2026.
Final reports on vulnerabilities must be submitted within 14 days of making a corrective measure available.
Serious incidents require a final report one month after the first report.
Notifications are addressed to the coordinating CSIRT determined under the CRA.
Manufacturers must inform affected users about available corrections or mitigations without undue delay.
Why It Matters
If you manufacture digital products for the EU market, the Cyber Resilience Act's reporting rules are now mandatory. Non-compliance can lead to massive fines, up to €15 million or 2.5% of annual turnover. This impacts all manufacturers, regardless of location, and requires a thorough understanding of your software supply chain.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,476 builders reading daily.