EU Cyber Resilience Act's Mandatory Vulnerability and Incident Reporting Requirements Go Live

Manufacturers placing products with digital elements on the EU market are now subject to mandatory vulnerability and incident reporting requirements under the Cyber Resilience Act (CRA). These obligations, which apply from September 11, 2026, mandate reporting of actively exploited vulnerabilities and severe security incidents within 24 hours of awareness, significantly ahead of the CRA's full application date in December 2027.