EU Cyber-Reporting Rules Start September 11: What Manufacturers Must Report

EU cyber-reporting rules start September 11: what manufacturers must report

Manufacturers of connected hardware and software covered by the EU Cyber Resilience Act must begin reporting actively exploited security flaws and severe product-security incidents from September 11, 2026. The first warning can be due within 24 hours of becoming aware of a reportable event.

Cyber Resilience Act reporting rules kick in - Are you CRA compliant? - Legal IT Insider

The EU’s Cyber Resilience Act (CRA) reaches a critical milestone tomorrow (11 September) as its incident reporting obligations officially take effect. Under the new framework, manufacturers, distributors and importers of […]

EU's 24-Hr Vulnerability Reporting Rules Take Effect Friday, A Year Before The Rest Of The Cyber Resilience Act

Manufacturers selling connected products in the European Union face a new legal duty starting Sept. 11. Report actively exploited vulnerabilities to authorities within 24 hours of confirming them. The obligation arrives 15 months ahead of the Cyber Resilience Act's full application date of Dec. 11, 2027, making it the regulation's first hard deadline. The CRA covers products with digital elements placed on the EU market, a category broad enough …

Finite State Customers Are Ready for CRA's September 11 Reporting Deadline

COLUMBUS, Ohio--(BUSINESS WIRE)-- #CRA--Finite State, a leader in product security and software supply-chain risk management, today announced that connected device manufacturers using its platform are ready for the EU Cyber Resilience Act's September 11 reporting obligations. These manufacturers will enter the deadline able to answer the notification's hardest question: whether an actively exploited vulnerability is present and reachable in the …