Loading story…
The EU Cyber Resilience Act (CRA) will impose cybersecurity requirements on hardware, software, and components sold in the EU, with broad applicability including commercially supplied offline firmware from microenterprises. Manufacturers will need to maintain technical documentation, issue an EU declaration of conformity, apply CE marking where required, provide security updates throughout the support period, and meet post-market vulnerability and incident-reporting obligations; some software not listed in Annex III may be eligible for self-assessment.
The Netherlands has proposed an implementing law that assigns conformity assessment, market surveillance, and enforcement to the Minister of Economic Affairs through the Rijksinspectie Digitale Infrastructuur (RDI). The National Cyber Security Centre (NCSC) would operate the national reporting portal as the designated CSIRT. CRA market requirements take effect on 11 December 2027, while manufacturers must begin reporting actively exploited vulnerabilities and severe incidents on 11 September 2026.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
The European Commission issued guidance C(2026) 5252 addressing CRA obligations, including that vulnerability handling ends with the support period while reporting obligations continue afterward.
The Netherlands opened a public consultation on a draft law to implement the EU Cyber Resilience Act operationally, including proposed designation of the RDI for oversight and market surveillance and the NCSC as the reporting-portal CSIRT.
The European Union adopted the Cyber Resilience Act as Regulation (EU) 2024/2847, establishing cybersecurity requirements for products with digital elements.
The Digital Trust Center was integrated into the Netherlands' National Cyber Security Centre.
The Dutch Ministry of Economic Affairs held an online information session covering the draft CRA implementing law and the Cyber Resilience Act.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
blog.compass-security.com
Open sourcenews.ycombinator.com
Open sourcencsc.nl
Open sourceeur-lex.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Union’s **Cyber Resilience Act (CRA)** is entering its first operational phase, with manufacturers of products with digital elements facing a key compliance deadline on **11 September 2026**. From that date, vendors selling software and connected hardware in the EU must report **actively exploited vulnerabilities** and **severe security incidents** through an **ENISA-operated Single Reporting Platform**, including an early warning within 24 hours of becoming aware of an issue and a fuller notification within 72 hours. The reporting duty is limited to cases with reliable evidence of active exploitation or incidents that seriously affect product security, rather than every discovered flaw. The CRA is the EU’s product-security framework for software and connectable hardware, designed to address weak default security, poor vulnerability handling, and inconsistent delivery of security updates across a product’s lifecycle. It requires manufacturers to build cybersecurity into planning, design, development, and maintenance, with some higher-risk products subject to third-party conformity assessment before sale in the EU and compliance signaled through **CE marking**. The European Commission has also issued implementation guidance clarifying scope, substantial modifications, support periods, and risk-assessment expectations, ahead of the broader CRA obligations taking effect in December 2027.
Aug 13, 2026
EU manufacturers of products with digital elements must begin meeting **Cyber Resilience Act (CRA) Article 14** reporting obligations on 11 September 2026, before the regulation becomes broadly applicable in December 2027. They must report reliably evidenced active exploitation of vulnerabilities affecting their products, as well as severe security incidents involving those products. The process requires an early notification within 24 hours, a more detailed notification within 72 hours, and a final report within one month of the initial notice. Requirements extend to legacy products already on the EU market and to exploited vulnerabilities in third-party software or hardware components that affect a manufacturer’s product; organizations need current product and component inventories, defined escalation paths, and coordinated vulnerability-management, incident-response, and regulatory-reporting procedures.
Sep 14, 2026
ETSI has launched the approval process for **17 draft European cybersecurity standards** intended to support implementation of the EU Cyber Resilience Act (CRA), expanding the compliance framework that will apply to commercial hardware and software sold in the EU. The drafts cover major product categories including network and edge devices, security products, and IoT appliances, and are designed to translate the CRA’s legal requirements into technical controls manufacturers and other suppliers can implement. The proposed standards call for baseline measures such as **modern cryptography**, **secure-by-default configurations**, **software bills of materials (SBOMs)**, and the ability to deliver security updates after sale. The drafts have entered public enquiry through late 2026, with final versions expected by December 2026 ahead of the CRA’s full application in December 2027; the resulting obligations are expected to affect manufacturers, importers, distributors, service providers, and developers placing connected products on the EU market.
Aug 18, 2026