The EU CRA's Real Question: What Shipped, and When Did You Know?

The EU CRA's Real Question: What Shipped, and When Did You Know?

The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws. ActiveState explains why knowing exactly what shipped and when vulnerabilities were discovered will be critical to meeting the new requirements. [...]

EU CRA reporting clock starts before engineering compliance

The EU Cyber Resilience Act begins mandatory incident reporting on 11 September 2026: manufacturers selling products with digital elements into the EU must notify ENISA within 24 hours of learning a vulnerability is being actively exploited, then file...