Loading story…
ETSI has launched the approval process for 17 draft European cybersecurity standards intended to support implementation of the EU Cyber Resilience Act (CRA), expanding the compliance framework that will apply to commercial hardware and software sold in the EU. The drafts cover major product categories including network and edge devices, security products, and IoT appliances, and are designed to translate the CRA’s legal requirements into technical controls manufacturers and other suppliers can implement.
The proposed standards call for baseline measures such as modern cryptography, secure-by-default configurations, software bills of materials (SBOMs), and the ability to deliver security updates after sale. The drafts have entered public enquiry through late 2026, with final versions expected by December 2026 ahead of the CRA’s full application in December 2027; the resulting obligations are expected to affect manufacturers, importers, distributors, service providers, and developers placing connected products on the EU market.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
ETSI launched the approval process for 17 key cybersecurity standards tied to the EU Cyber Resilience Act and submitted the drafts to 41 member organizations across Europe. The standards entered the public enquiry phase as the first step of the approval procedure.
On August 13, ETSI made available 17 draft European cybersecurity standards intended to support implementation of the EU Cyber Resilience Act. The drafts cover major product categories such as network and edge devices, security products, and IoT appliances, and define baseline requirements including modern cryptography, secure-by-default settings, SBOMs, and post-sale update capabilities.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceinfosecurity-magazine.com
Open sourceetsi.org
Open sourcedocbox.etsi.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Union’s **Cyber Resilience Act (CRA)** is entering its first operational phase, with manufacturers of products with digital elements facing a key compliance deadline on **11 September 2026**. From that date, vendors selling software and connected hardware in the EU must report **actively exploited vulnerabilities** and **severe security incidents** through an **ENISA-operated Single Reporting Platform**, including an early warning within 24 hours of becoming aware of an issue and a fuller notification within 72 hours. The reporting duty is limited to cases with reliable evidence of active exploitation or incidents that seriously affect product security, rather than every discovered flaw. The CRA is the EU’s product-security framework for software and connectable hardware, designed to address weak default security, poor vulnerability handling, and inconsistent delivery of security updates across a product’s lifecycle. It requires manufacturers to build cybersecurity into planning, design, development, and maintenance, with some higher-risk products subject to third-party conformity assessment before sale in the EU and compliance signaled through **CE marking**. The European Commission has also issued implementation guidance clarifying scope, substantial modifications, support periods, and risk-assessment expectations, ahead of the broader CRA obligations taking effect in December 2027.
Aug 13, 2026
The EU Cyber Resilience Act (CRA) will impose cybersecurity requirements on hardware, software, and components sold in the EU, with broad applicability including commercially supplied offline firmware from microenterprises. Manufacturers will need to maintain technical documentation, issue an EU declaration of conformity, apply CE marking where required, provide security updates throughout the support period, and meet post-market vulnerability and incident-reporting obligations; some software not listed in Annex III may be eligible for self-assessment. The Netherlands has proposed an implementing law that assigns conformity assessment, market surveillance, and enforcement to the Minister of Economic Affairs through the Rijksinspectie Digitale Infrastructuur (RDI). The National Cyber Security Centre (NCSC) would operate the national reporting portal as the designated CSIRT. CRA market requirements take effect on 11 December 2027, while manufacturers must begin reporting actively exploited vulnerabilities and severe incidents on 11 September 2026.
Sep 3, 2026
EU manufacturers of products with digital elements must begin meeting **Cyber Resilience Act (CRA) Article 14** reporting obligations on 11 September 2026, before the regulation becomes broadly applicable in December 2027. They must report reliably evidenced active exploitation of vulnerabilities affecting their products, as well as severe security incidents involving those products. The process requires an early notification within 24 hours, a more detailed notification within 72 hours, and a final report within one month of the initial notice. Requirements extend to legacy products already on the EU market and to exploited vulnerabilities in third-party software or hardware components that affect a manufacturer’s product; organizations need current product and component inventories, defined escalation paths, and coordinated vulnerability-management, incident-response, and regulatory-reporting procedures.
Sep 14, 2026