Cyber Resilience Act
EU regulation imposing cybersecurity requirements on connected hardware and software products.
The EU's Cyber Resilience Act began its first live enforcement obligation on 11 September 2026, requiring manufacturers to report an actively exploited flaw within 24 hours or risk fines of up to €15 million.
Last refreshed: 2 October 2026 · Appears in 2 active topics
If the UK ICO is already enforcing NCSC baseline guidance under GDPR, what does the CRA add?
Timeline for Cyber Resilience Act
Mentioned in: CISA set three-day deadlines on 34 flaws
Cybersecurity: Threats and DefencesTook effect, requiring 24-hour vulnerability reporting
European Tech Sovereignty: Cyber Resilience Act starts its clockENISA updates its single-reporting platform FAQ
Cybersecurity: Threats and DefencesMentioned in: Magento RCE forces 9-day patch race
Cybersecurity: Threats and DefencesMentioned in: EU backs open source with €2bn plan
European Tech SovereigntyBackground
The Cyber Resilience Act (CRA) was adopted by the European Parliament in March 2024, introducing mandatory cybersecurity requirements for any hardware or software product placed on the EU market that contains digital elements: IoT devices, operating systems and connected industrial equipment. It treats cybersecurity as a product characteristic rather than an optional ADD-on, requiring vulnerability assessment, security-by-design principles and five-year vulnerability disclosure obligations.
Application is staggered. The Act entered into force on 10 December 2024. The conformity-assessment-body framework applied from 11 June 2026. Reporting obligations under Article 14 applied from 11 September 2026. The bulk of the regulation, including essential cybersecurity requirements and CE marking, applies in full from 11 December 2027, after which products with digital elements must complete conformity assessment before sale in the EU. Penalties for non-compliance reach up to 2.5% of a company's global annual turnover.
CRA reporting duty goes live
The Cyber Resilience Act's Article 14 reporting obligation began applying on 11 September 2026: manufacturers must WARN authorities within 24 hours of becoming aware of an actively exploited vulnerability, and file a full notification within 72 hours, with fines of up to €15 million. The duty already covers legacy products, not only new ones, and lands on the commercial vendor rather than the open-source code many products contain.
That distinction was settled in March 2026, when the European Commission's draft implementation guidance placed compliance responsibility on whoever 'puts software into service', not volunteer maintainers, the outcome open-source groups had lobbied for. The Act's bulk, including CE marking and full conformity assessment, still does not apply until 11 December 2027.