Cyber Resilience Act reporting obligations apply from 11 September 2026

Regulation (EU) 2024/2847 (the Cyber Resilience Act) entered into force on 10 December 2024. Its reporting obligations apply from 11 September 2026, ahead of the main obligations from 11 December 2027. The CRA sets cybersecurity requirements for products with digital elements placed on the EU market, including vulnerability handling and CE-marking conformity.

The first CRA obligation to bite is reporting: from 11 September 2026 manufacturers must be able to report actively exploited vulnerabilities and severe incidents. That capability takes process and tooling work — it cannot be stood up in the final week.

Manufacturers, importers and distributors of hardware and software products with digital elements sold in the EU.

Stand up the internal process to detect, triage and report actively exploited vulnerabilities and severe incidents from 11 September 2026; confirm the exact triggers, channels and timelines in the regulation text.