# EU Cyber Resilience Act: vulnerability reporting began September 11, 2026, with main obligations from December 2027 > The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking. - Canonical URL: https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:01:29+00:00 - Modified: 2026-10-18T22:22:09+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Briefing - DSE priority: Advisory - Topics: Cybersecurity, Networks & Infrastructure - Reading time: 2 minutes ## What you need to know The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking. ## Potentially affected Manufacturers of connected hardware and software sold in the EU, including cameras, access control and network devices, and organizations that buy from them. ## DSE recommendation DSE recommends asking device and software vendors how they meet the CRA’s reporting and support-period obligations, and using those answers when choosing products. ## Article The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking. ## Source facts The European Commission’s [Cyber Resilience Act page](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) says the CRA introduces mandatory cybersecurity requirements for manufacturers covering the planning, design, development and maintenance of hardware and software products with digital elements, which will bear CE marking to show compliance. It entered into force on 10 December 2024, its main obligations apply from 11 December 2027 and reporting obligations apply as of 11 September 2026; on 27 July 2026 the Commission published practical guidance. The [reporting obligations page](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting) says manufacturers must notify actively exploited vulnerabilities and severe incidents affecting product security, with an early warning within 24 hours of becoming aware and a full notification within 72 hours, through the CRA Single Reporting Platform that ENISA made operational on 11 September 2026. A final report is due no later than 14 days after a corrective measure is available for exploited vulnerabilities, and within a month of the 72-hour notification for severe incidents. The [manufacturers page](https://digital-strategy.ec.europa.eu/en/policies/cra-manufacturers) says products must be designed to be foundationally secure, including security by default with no “password” default password, access control, cryptography and automatic updates. Manufacturers must indicate a support period, handle vulnerabilities during it, and maintain products for the time they are expected to be in use. ## Applicability Use this for products placed on the EU market and as a benchmark for buyers elsewhere. The CRA is EU law, so for US purchases treat it as a reference point when comparing vendors rather than a requirement. ## DSE recommendation DSE recommends asking device and software vendors how they meet the CRA’s reporting and support-period obligations, and using those answers when choosing products. Ask for the declared support period, the vulnerability reporting contact and process, and how updates are delivered, prefer products with a published end-of-support date, and record the answers in the asset inventory. ## Verification Review vendor answers at each purchase and renewal, confirm declared support periods are tracked in the inventory, and check vendor security advisories for products in use. ## Official references [European Commission — Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act). [European Commission — Cyber Resilience Act: Reporting obligations](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting). [European Commission — Cyber Resilience Act: Manufacturers](https://digital-strategy.ec.europa.eu/en/policies/cra-manufacturers). Reviewed October 18, 2026. ## Primary reference - Name: European Commission — Cyber Resilience Act - Authority: digital-strategy.ec.europa.eu - URL: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act - Source publication date: Not stated by the source ## Citation and use Preferred citation: “EU Cyber Resilience Act: vulnerability reporting began September 11, 2026, with main obligations from December 2027,” DSE Security, https://update.dsesecurity.com/updates/eu-cyber-resilience-act-reporting-september-2026-december-2027-device-buyers/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.