EU Cyber Resilience Act Initiates 24-Hour Vulnerability Reporting for Tech Manufacturers

Effective September 11, 2026, manufacturers of hardware and software products with digital elements covered by the EU Cyber Resilience Act (CRA) must report actively exploited vulnerabilities and severe security incidents within 24 hours of becoming aware of them. This marks a critical new regulatory phase for cybersecurity in the European Union, preceding most other CRA obligations which take effect in December 2027.