EU Cyber Resilience Act: vulnerability reporting began September 11, 2026, with main obligations from December 2027

The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027, including secure-by-default design, a stated support period and CE marking.

Source facts

The European Commission’s Cyber Resilience Act page says the CRA introduces mandatory cybersecurity requirements for manufacturers covering the planning, design, development and maintenance of hardware and software products with digital elements, which will bear CE marking to show compliance. It entered into force on 10 December 2024, its main obligations apply from 11 December 2027 and reporting obligations apply as of 11 September 2026; on 27 July 2026 the Commission published practical guidance.

The reporting obligations page says manufacturers must notify actively exploited vulnerabilities and severe incidents affecting product security, with an early warning within 24 hours of becoming aware and a full notification within 72 hours, through the CRA Single Reporting Platform that ENISA made operational on 11 September 2026. A final report is due no later than 14 days after a corrective measure is available for exploited vulnerabilities, and within a month of the 72-hour notification for severe incidents.

The manufacturers page says products must be designed to be foundationally secure, including security by default with no “password” default password, access control, cryptography and automatic updates. Manufacturers must indicate a support period, handle vulnerabilities during it, and maintain products for the time they are expected to be in use.

Applicability

Use this for products placed on the EU market and as a benchmark for buyers elsewhere. The CRA is EU law, so for US purchases treat it as a reference point when comparing vendors rather than a requirement.

DSE recommendation

DSE recommends asking device and software vendors how they meet the CRA’s reporting and support-period obligations, and using those answers when choosing products. Ask for the declared support period, the vulnerability reporting contact and process, and how updates are delivered, prefer products with a published end-of-support date, and record the answers in the asset inventory.

Verification

Review vendor answers at each purchase and renewal, confirm declared support periods are tracked in the inventory, and check vendor security advisories for products in use.

Official references

European Commission — Cyber Resilience Act. European Commission — Cyber Resilience Act: Reporting obligations. European Commission — Cyber Resilience Act: Manufacturers. Reviewed October 18, 2026.