From today, the first major obligations of the EU Cyber Resilience Act apply. Manufacturers of products with digital elements sold in the EU must report:
- Actively exploited vulnerabilities in their products.
- Severe incidents affecting the security of their products.
Reports go through ENISA’s Single Reporting Platform, with an early warning within 24 hours, a notification within 72 hours and a final report afterwards.
This applies to products already on the market, not just new ones. Manufacturers need effective vulnerability monitoring, triage and escalation processes, and a clear route for reporting within 24 hours. The remaining CRA requirements, including security by design and CE marking, apply from 11 December 2027.
Source: Regulation (EU) 2024/2847 – Cyber Resilience Act (EUR-Lex)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
