Loading story…
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, has begun its vulnerability-reporting phase: manufacturers of hardware and software products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents to ENISA and relevant national CSIRTs. The staged reporting obligations, including an initial report within 24 hours, apply to products already on the market as well as new offerings.
The CRA took effect in December 2024, with conformity-assessment body notifications beginning in June 2026; full enforcement and mandatory CE marking are scheduled for December 2027. Organizations subject to the regulation need established processes to rapidly classify incidents, verify production impact, coordinate legal, security, and product stakeholders, and make defensible disclosures amid overlapping requirements under GDPR, NIS2, DORA, SEC rules, and anticipated CIRCIA obligations.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
CRA reporting obligations began applying to manufacturers of digital products sold in the EU, including products already on the market. They require reporting actively exploited vulnerabilities and severe incidents to ENISA and relevant national CSIRTs, starting with an early warning within 24 hours.
Notifications for Cyber Resilience Act conformity-assessment bodies began.
Regulation (EU) 2024/2847, the European Union Cyber Resilience Act, took effect and became directly applicable across EU member states.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Union’s **Cyber Resilience Act (CRA)** is entering its first operational phase, with manufacturers of products with digital elements facing a key compliance deadline on **11 September 2026**. From that date, vendors selling software and connected hardware in the EU must report **actively exploited vulnerabilities** and **severe security incidents** through an **ENISA-operated Single Reporting Platform**, including an early warning within 24 hours of becoming aware of an issue and a fuller notification within 72 hours. The reporting duty is limited to cases with reliable evidence of active exploitation or incidents that seriously affect product security, rather than every discovered flaw. The CRA is the EU’s product-security framework for software and connectable hardware, designed to address weak default security, poor vulnerability handling, and inconsistent delivery of security updates across a product’s lifecycle. It requires manufacturers to build cybersecurity into planning, design, development, and maintenance, with some higher-risk products subject to third-party conformity assessment before sale in the EU and compliance signaled through **CE marking**. The European Commission has also issued implementation guidance clarifying scope, substantial modifications, support periods, and risk-assessment expectations, ahead of the broader CRA obligations taking effect in December 2027.
Aug 13, 2026
EU manufacturers of products with digital elements must begin meeting **Cyber Resilience Act (CRA) Article 14** reporting obligations on 11 September 2026, before the regulation becomes broadly applicable in December 2027. They must report reliably evidenced active exploitation of vulnerabilities affecting their products, as well as severe security incidents involving those products. The process requires an early notification within 24 hours, a more detailed notification within 72 hours, and a final report within one month of the initial notice. Requirements extend to legacy products already on the EU market and to exploited vulnerabilities in third-party software or hardware components that affect a manufacturer’s product; organizations need current product and component inventories, defined escalation paths, and coordinated vulnerability-management, incident-response, and regulatory-reporting procedures.
Sep 15, 2026
The EU Cyber Resilience Act (CRA) will impose cybersecurity requirements on hardware, software, and components sold in the EU, with broad applicability including commercially supplied offline firmware from microenterprises. Manufacturers will need to maintain technical documentation, issue an EU declaration of conformity, apply CE marking where required, provide security updates throughout the support period, and meet post-market vulnerability and incident-reporting obligations; some software not listed in Annex III may be eligible for self-assessment. The Netherlands has proposed an implementing law that assigns conformity assessment, market surveillance, and enforcement to the Minister of Economic Affairs through the Rijksinspectie Digitale Infrastructuur (RDI). The National Cyber Security Centre (NCSC) would operate the national reporting portal as the designated CSIRT. CRA market requirements take effect on 11 December 2027, while manufacturers must begin reporting actively exploited vulnerabilities and severe incidents on 11 September 2026.
Sep 3, 2026