Loading story…
EU manufacturers of products with digital elements must begin meeting Cyber Resilience Act (CRA) Article 14 reporting obligations on 11 September 2026, before the regulation becomes broadly applicable in December 2027. They must report reliably evidenced active exploitation of vulnerabilities affecting their products, as well as severe security incidents involving those products.
The process requires an early notification within 24 hours, a more detailed notification within 72 hours, and a final report within one month of the initial notice. Requirements extend to legacy products already on the EU market and to exploited vulnerabilities in third-party software or hardware components that affect a manufacturer’s product; organizations need current product and component inventories, defined escalation paths, and coordinated vulnerability-management, incident-response, and regulatory-reporting procedures.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
ENISA launched and began operating the Cyber Resilience Act Single Reporting Platform, a common electronic system for manufacturers to report actively exploited vulnerabilities and severe incidents. Notifications are sent to a designated coordinating CSIRT, made available to ENISA, and disseminated to relevant Member State CSIRTs.
The European Union Cyber Resilience Act entered into force, beginning the transition toward its phased application and manufacturer cybersecurity requirements for products with digital elements.
The European Parliament and the Council adopted Regulation (EU) 2024/2847, establishing the EU Cyber Resilience Act and its horizontal cybersecurity requirements for products with digital elements placed on the EU market.
The European Commission published new guidance intended to support timely implementation of the EU Cyber Resilience Act.
EU Cyber Resilience Act Article 14 reporting obligations begin for manufacturers of products with digital elements, requiring reporting of reliably evidenced active exploitation and severe product-security incidents through staged notifications.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
22 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcevulncheck.com
Open sourcedigital-strategy.ec.europa.eu
Open sourcetheregister.com
Open sourceeur-lex.europa.eu
Open sourceeur-lex.europa.eu
Open sourcedigital-strategy.ec.europa.eu
Open sourceec.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Union’s **Cyber Resilience Act (CRA)** is entering its first operational phase, with manufacturers of products with digital elements facing a key compliance deadline on **11 September 2026**. From that date, vendors selling software and connected hardware in the EU must report **actively exploited vulnerabilities** and **severe security incidents** through an **ENISA-operated Single Reporting Platform**, including an early warning within 24 hours of becoming aware of an issue and a fuller notification within 72 hours. The reporting duty is limited to cases with reliable evidence of active exploitation or incidents that seriously affect product security, rather than every discovered flaw. The CRA is the EU’s product-security framework for software and connectable hardware, designed to address weak default security, poor vulnerability handling, and inconsistent delivery of security updates across a product’s lifecycle. It requires manufacturers to build cybersecurity into planning, design, development, and maintenance, with some higher-risk products subject to third-party conformity assessment before sale in the EU and compliance signaled through **CE marking**. The European Commission has also issued implementation guidance clarifying scope, substantial modifications, support periods, and risk-assessment expectations, ahead of the broader CRA obligations taking effect in December 2027.
Aug 13, 2026
The EU Cyber Resilience Act (CRA) will impose cybersecurity requirements on hardware, software, and components sold in the EU, with broad applicability including commercially supplied offline firmware from microenterprises. Manufacturers will need to maintain technical documentation, issue an EU declaration of conformity, apply CE marking where required, provide security updates throughout the support period, and meet post-market vulnerability and incident-reporting obligations; some software not listed in Annex III may be eligible for self-assessment. The Netherlands has proposed an implementing law that assigns conformity assessment, market surveillance, and enforcement to the Minister of Economic Affairs through the Rijksinspectie Digitale Infrastructuur (RDI). The National Cyber Security Centre (NCSC) would operate the national reporting portal as the designated CSIRT. CRA market requirements take effect on 11 December 2027, while manufacturers must begin reporting actively exploited vulnerabilities and severe incidents on 11 September 2026.
Sep 3, 2026
ETSI has launched the approval process for **17 draft European cybersecurity standards** intended to support implementation of the EU Cyber Resilience Act (CRA), expanding the compliance framework that will apply to commercial hardware and software sold in the EU. The drafts cover major product categories including network and edge devices, security products, and IoT appliances, and are designed to translate the CRA’s legal requirements into technical controls manufacturers and other suppliers can implement. The proposed standards call for baseline measures such as **modern cryptography**, **secure-by-default configurations**, **software bills of materials (SBOMs)**, and the ability to deliver security updates after sale. The drafts have entered public enquiry through late 2026, with final versions expected by December 2026 ahead of the CRA’s full application in December 2027; the resulting obligations are expected to affect manufacturers, importers, distributors, service providers, and developers placing connected products on the EU market.
Aug 18, 2026