EU Cyber Resilience Act

The EU's Cyber Resilience Act (Regulation 2024/2847) is the first EU-wide law imposing binding product security requirements on software and connected hardware, regardless of where the manufacturer is based.

Since September 11, 2026, manufacturers must warn their national CSIRT within 24 hours of learning a defect is actively exploited, notify fully within 72 hours, and file a final report within 14 days of a fix being available. ENISA sees all of it. Full requirements apply December 11, 2027.

Selling into the EU means designing for a reporting clock, not just a standard.

Discussion prompts

• Does your organization know which of its products fall under the CRA's manufacturer obligations today?
• Could your team meet a 24-hour reporting deadline for an actively exploited defect right now?
• How does a reporting duty change what "shipping fast" means for a manufacturer selling into the EU?