Countdown to the next EU CRA milestone

What is the EU Cyber Resilience Act, and why does it matter?

The CRA is a sweeping regulatory framework that mandates security for products with digital elements. This includes

• Software (any form)
• Firmware or embedded software inside hardware
• Digital components or libraries sold separately
• Remote processing tied to the product (e.g., cloud services required for functionality)

Nonconformity can result in EU market access blockage, substantial fines, increased legal risk, product recalls, and can lead to reputational damage.

When do the requirements kick in?

Manufacturer reporting obligations under Article 14 take effect in September 2026, sooner than many organizations realize.

Full CRA requirements covering security obligations for all new and substantially modified products placed on the EU market apply from December 2027.
 

What are the reporting timelines?

Once you become aware of an actively exploited vulnerability or severe incident impacting your product, your obligations are

• Within 24 hours: Submit an early warning notification
• Within 72 hours: Submit a triage report that includes a resolution path
• Within 14 days: Submit a final report after mitigation

These timelines leave almost no room for manual, ad hoc processes. If your current incident response workflow isn’t built for this cadence, that’s a critical gap to close now.

How can organizations prepare?

Start with your reporting infrastructure. You need incident reporting procedures that are documented, tested, and integrated into your broader information security management system, not bolted on as an afterthought.

• Baseline against IEC 62443. This provides a solid foundation for the security practices the CRA expects.
• Stand up incident reporting workflows. Prioritize the processes that support Article 14 timelines.
• Automate vulnerability management. Your tooling needs to detect and identify issues faster than humans can manually track.
• Document everything. Conformity you can’t prove is conformity that won’t hold up.