If you sell software or connected hardware into the EU market, the Cyber Resilience Act applies to you whether or not you’re based there — and its first binding deadline is closer than most vendors’ current compliance roadmaps assume.
The Cyber Resilience Act (CRA) covers “products with digital elements” placed on the EU…
September 11, 2026 — reporting obligations begin. Manufacturers must report actively…
Article 14’s reporting timeline is tight and specific.
The Cyber Resilience Act (CRA) covers “products with digital elements” placed on the EU market — a deliberately broad scope spanning standalone software, connected hardware, and remote data processing solutions tied to a product. It names specific categories for extra scrutiny: identity management systems, browsers, password managers, VPN products, routers, and operating systems sit in the “important” product category, with tighter conformity assessment requirements than general software.
Article 14’s reporting timeline is tight and specific. For an actively exploited vulnerability: an early warning within 24 hours of becoming aware of it, a fuller vulnerability notification within 72 hours, and a final report within 14 days of a corrective or mitigating measure becoming available. For a severe incident affecting the availability, integrity, authenticity, or confidentiality of a product’s data or functions: the same 24-hour and 72-hour cadence, with a final report within one month of the incident notification.
A 24-hour early-warning requirement assumes an organization already has the internal process to detect, triage, and escalate a vulnerability or incident fast enough to hit that window — which is a security operations and incident response capability, not a compliance documentation exercise. Vendors whose current incident response process measures response time in days, not hours, have real operational work to do before this deadline, not just a policy to write.
Yes, if you place products with digital elements on the EU market — the CRA applies based on where products are sold and used, not where the manufacturer is headquartered, similar in reach to how GDPR applies extraterritorially.
September 2026 starts the vulnerability and incident reporting obligations specifically. December 2027 brings the full regime into force, including CE marking, conformity assessment, and the broader essential cybersecurity requirements that apply to the product itself, not just incident reporting.
The CRA includes specific provisions distinguishing commercial products from non-commercial open-source software development, with lighter obligations for genuinely open, non-commercial projects — but software that’s open-source and also commercially distributed or supported as part of a product generally falls under the standard requirements. This distinction has enough nuance that it’s worth confirming your specific situation against the current guidance rather than assuming either way.