Dalio Partners
What Just Changed
As of 11 September 2026, the EU Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe security incidents affecting products with digital elements.
How The Clock Runs
- 24 hours for an early warning
- 72 hours for the main notification
- For vulnerabilities, a final report within 14 days after a corrective measure becomes available; severe incidents follow a separate one-month deadline
What It Doesn't Cover
Not every digital service falls within the Cyber Resilience Act. The distinction can become more complex where a physical or software product relies on remote data-processing services, making scope something companies should assess before entering the EU market.
What's Still Ahead
Most CRA requirements, including cybersecurity-by-design obligations and CE marking, apply from 11 December 2027. The reporting obligations, however, have already applied since 11 September 2026.
One question we get asked often: does this matter if the product was developed outside the EU? Yes. Non-EU manufacturers must comply with the CRA when placing covered products on the EU market.