Already 11. September 2026 the first obligations arising from the Cyber Resilience Act (Cyber Resilience Act “CRA”),
This European Union regulation sets the conditions for the development of secure products with digital elements and aims to:
- increasing the safety of products supplied to the EU market,
- reducing vulnerabilities in products and implementing procedures to address them,
- introduction of mandatory reporting of exploited vulnerabilities and serious cyber incidents,
- improving cybersecurity awareness among ordinary end users of products.
What does the act cover?
The scope of the regulation includes so-called products with digital elements, which are both software and hardware and whose intended use requires a data connection to a device or network - i.e. the transmission of digitally encoded information between the sender and the recipient.
What is changing?
Although the regulation will not enter into full effect until December 11, 2027, The first obligations for manufacturers come into effect on September 11, 2026. Article 14, which regulates the reporting obligation, enters into force on this day. Manufacturers must start reporting all actively exploited vulnerabilities and serious incidents affecting product security:
- to 24 hours from the moment the incident is discovered, the manufacturer must file preliminary report through a single European platform managed by ENISA,
- to 72 hours then this notification must be supplemented with more detailed technical information.
What does this mean for companies?
This obligation means in practice that the affected companies must have internal processes in place to detect incidents, rapid assessment and timely reporting. It is also advisable to prepare in time for the fulfillment of other obligations that the Cyber Resilience Act will bring, such as determining the products falling within the scope of the regulation or classifying them into certain categories.
A law on cybersecurity requirements for products with digital elements is also being prepared, which will specify who will supervise compliance with the regulation and enforce sanctions.
Do you need help preparing for your new responsibilities? Contact us, we will be happy to help you.
