The first major EU Cyber Resilience Act (the “CRA“) compliance deadline is fast approaching. From 11 September 2026, manufacturers within scope of the CRA must comply with new reporting obligations for actively exploited vulnerabilities and severe incidents. These requirements take effect more than a year before the CRA’s substantive provisions, making them an early priority for organisations preparing for compliance.
For manufacturers, the challenge is not simply understanding the reporting requirements but also to operationalise. The CRA introduces reporting timelines measured in hours rather than days – manufacturers must submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours – requiring organisations to establish governance structures, escalation pathways and technical capabilities capable of determining whether a reportable event has occurred and submitting notifications within tight regulatory deadlines.
Read our latest article to understand the scope of the reporting obligations, the key areas of regulatory uncertainty and the steps manufacturers should take to prepare.
Recent Comments