CRA Reporting Is Live — Are You Ready?
The EU Cyber Resilience Act Article 14 reporting obligations are now in effect. As of 11 September 2026, manufacturers, importers, and distributors placing products with digital elements on the EU market must notify ENISA within 24 hours of becoming aware of an actively exploited vulnerability, and there are additional obligations at 72 hours and 14 days. For AppSec and cybersecurity teams, this is no longer a compliance exercise on the horizon. It is an operational reality that starts now.
Join Black Duck’s security experts for a candid, practitioner-focused briefing . We’ll tell you exactly what’s changed, what the industry has—and hasn’t—done to prepare, and where we stand on what good looks like.
You'll walk away with:
- A clear breakdown of the 24-hour/72-hour/14-day reporting sequence and what it demands of your team
- An honest read on where the industry stands, including what’s been done, what’s missing, and where exposure risk is highest
- Black Duck’s perspective on compliance, and how our solutions support SBOM, vulnerability monitoring, and reporting workflows
- Immediate next steps regardless of where you are in your compliance journe
