The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking.
\nThe European Commission’s Cyber Resilience Act page says the CRA introduces mandatory cybersecurity requirements for manufacturers covering the planning, design, development and maintenance of hardware and software products with digital elements, which will bear CE marking to show compliance. It entered into force on 10 December 2024, its main obligations apply from 11 December 2027 and reporting obligations apply as of 11 September 2026; on 27 July 2026 the Commission published practical guidance.
\nThe reporting obligations page says manufacturers must notify actively exploited vulnerabilities and severe incidents affecting product security, with an early warning within 24 hours of becoming aware and a full notification within 72 hours, through the CRA Single Reporting Platform that ENISA made operational on 11 September 2026. A final report is due no later than 14 days after a corrective measure is available for exploited vulnerabilities, and within a month of the 72-hour notification for severe incidents.
\nThe manufacturers page says products must be designed to be foundationally secure, including security by default with no “password” default password, access control, cryptography and automatic updates. Manufacturers must indicate a support period, handle vulnerabilities during it, and maintain products for the time they are expected to be in use.
\nUse this for products placed on the EU market and as a benchmark for buyers elsewhere. The CRA is EU law, so for US purchases treat it as a reference point when comparing vendors rather than a requirement.
\nDSE recommends asking device and software vendors how they meet the CRA’s reporting and support-period obligations, and using those answers when choosing products. Ask for the declared support period, the vulnerability reporting contact and process, and how updates are delivered, prefer products with a published end-of-support date, and record the answers in the asset inventory.
\nReview vendor answers at each purchase and renewal, confirm declared support periods are tracked in the inventory, and check vendor security advisories for products in use.
\nEuropean Commission — Cyber Resilience Act. European Commission — Cyber Resilience Act: Reporting obligations. European Commission — Cyber Resilience Act: Manufacturers. Reviewed October 18, 2026.
", "content_text": "The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking.\nSource facts\nThe European Commission’s Cyber Resilience Act page says the CRA introduces mandatory cybersecurity requirements for manufacturers covering the planning, design, development and maintenance of hardware and software products with digital elements, which will bear CE marking to show compliance. It entered into force on 10 December 2024, its main obligations apply from 11 December 2027 and reporting obligations apply as of 11 September 2026; on 27 July 2026 the Commission published practical guidance.\nThe reporting obligations page says manufacturers must notify actively exploited vulnerabilities and severe incidents affecting product security, with an early warning within 24 hours of becoming aware and a full notification within 72 hours, through the CRA Single Reporting Platform that ENISA made operational on 11 September 2026. A final report is due no later than 14 days after a corrective measure is available for exploited vulnerabilities, and within a month of the 72-hour notification for severe incidents.\nThe manufacturers page says products must be designed to be foundationally secure, including security by default with no “password” default password, access control, cryptography and automatic updates. Manufacturers must indicate a support period, handle vulnerabilities during it, and maintain products for the time they are expected to be in use.\nApplicability\nUse this for products placed on the EU market and as a benchmark for buyers elsewhere. The CRA is EU law, so for US purchases treat it as a reference point when comparing vendors rather than a requirement.\nDSE recommendation\nDSE recommends asking device and software vendors how they meet the CRA’s reporting and support-period obligations, and using those answers when choosing products. Ask for the declared support period, the vulnerability reporting contact and process, and how updates are delivered, prefer products with a published end-of-support date, and record the answers in the asset inventory.\nVerification\nReview vendor answers at each purchase and renewal, confirm declared support periods are tracked in the inventory, and check vendor security advisories for products in use.\nOfficial references\nEuropean Commission — Cyber Resilience Act. European Commission — Cyber Resilience Act: Reporting obligations. European Commission — Cyber Resilience Act: Manufacturers. Reviewed October 18, 2026.", "content_markdown": "The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking.\n\n## Source facts\n\nThe European Commission’s [Cyber Resilience Act page](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) says the CRA introduces mandatory cybersecurity requirements for manufacturers covering the planning, design, development and maintenance of hardware and software products with digital elements, which will bear CE marking to show compliance. It entered into force on 10 December 2024, its main obligations apply from 11 December 2027 and reporting obligations apply as of 11 September 2026; on 27 July 2026 the Commission published practical guidance.\n\nThe [reporting obligations page](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting) says manufacturers must notify actively exploited vulnerabilities and severe incidents affecting product security, with an early warning within 24 hours of becoming aware and a full notification within 72 hours, through the CRA Single Reporting Platform that ENISA made operational on 11 September 2026. A final report is due no later than 14 days after a corrective measure is available for exploited vulnerabilities, and within a month of the 72-hour notification for severe incidents.\n\nThe [manufacturers page](https://digital-strategy.ec.europa.eu/en/policies/cra-manufacturers) says products must be designed to be foundationally secure, including security by default with no “password” default password, access control, cryptography and automatic updates. Manufacturers must indicate a support period, handle vulnerabilities during it, and maintain products for the time they are expected to be in use.\n\n## Applicability\n\nUse this for products placed on the EU market and as a benchmark for buyers elsewhere. The CRA is EU law, so for US purchases treat it as a reference point when comparing vendors rather than a requirement.\n\n## DSE recommendation\n\nDSE recommends asking device and software vendors how they meet the CRA’s reporting and support-period obligations, and using those answers when choosing products. Ask for the declared support period, the vulnerability reporting contact and process, and how updates are delivered, prefer products with a published end-of-support date, and record the answers in the asset inventory.\n\n## Verification\n\nReview vendor answers at each purchase and renewal, confirm declared support periods are tracked in the inventory, and check vendor security advisories for products in use.\n\n## Official references\n\n[European Commission — Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act). [European Commission — Cyber Resilience Act: Reporting obligations](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting). [European Commission — Cyber Resilience Act: Manufacturers](https://digital-strategy.ec.europa.eu/en/policies/cra-manufacturers). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/", "url": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "EU Cyber Resilience Act: vulnerability reporting began September 11, 2026, with main obligations from December 2027", "item": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/#article", "identifier": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/", "url": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/", "headline": "EU Cyber Resilience Act: vulnerability reporting began September 11, 2026, with main obligations from December 2027", "description": "The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe…", "abstract": "The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking.", "articleBody": "The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking.\nSource facts\nThe European Commission’s Cyber Resilience Act page says the CRA introduces mandatory cybersecurity requirements for manufacturers covering the planning, design, development and maintenance of hardware and software products with digital elements, which will bear CE marking to show compliance. It entered into force on 10 December 2024, its main obligations apply from 11 December 2027 and reporting obligations apply as of 11 September 2026; on 27 July 2026 the Commission published practical guidance.\nThe reporting obligations page says manufacturers must notify actively exploited vulnerabilities and severe incidents affecting product security, with an early warning within 24 hours of becoming aware and a full notification within 72 hours, through the CRA Single Reporting Platform that ENISA made operational on 11 September 2026. A final report is due no later than 14 days after a corrective measure is available for exploited vulnerabilities, and within a month of the 72-hour notification for severe incidents.\nThe manufacturers page says products must be designed to be foundationally secure, including security by default with no “password” default password, access control, cryptography and automatic updates. Manufacturers must indicate a support period, handle vulnerabilities during it, and maintain products for the time they are expected to be in use.\nApplicability\nUse this for products placed on the EU market and as a benchmark for buyers elsewhere. The CRA is EU law, so for US purchases treat it as a reference point when comparing vendors rather than a requirement.\nDSE recommendation\nDSE recommends asking device and software vendors how they meet the CRA’s reporting and support-period obligations, and using those answers when choosing products. Ask for the declared support period, the vulnerability reporting contact and process, and how updates are delivered, prefer products with a published end-of-support date, and record the answers in the asset inventory.\nVerification\nReview vendor answers at each purchase and renewal, confirm declared support periods are tracked in the inventory, and check vendor security advisories for products in use.\nOfficial references\nEuropean Commission — Cyber Resilience Act. European Commission — Cyber Resilience Act: Reporting obligations. European Commission — Cyber Resilience Act: Manufacturers. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:29+00:00", "dateModified": "2026-10-18T22:22:09+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "EU Cyber Resilience Act: vulnerability reporting began September 11, 2026, with main obligations from December 2027" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Briefing", "Advisory priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 377, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "European Commission — Cyber Resilience Act", "url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act" } } ] } }