Cyber Resilience Act11 Sep 2026
ENISA has deployed the initial operating capability of the Single Reporting Platform, the tool through which manufacturers report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act. ENISA states that these reporting obligations apply to manufacturers from 11 September 2026, that a notification goes to the coordinating CSIRT and is made available to ENISA, and that the obligations for open-source software stewards apply from 11 December 2027.
What to do: If you manufacture products with digital elements placed on the EU market, make sure your vulnerability-handling process can report actively exploited vulnerabilities and severe incidents through the Single Reporting Platform now.
Legal status: EU guidance · Jurisdiction: EU
Official source: ENISA ↗