Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 23 SEPTEMBER 2026

Incident Reporting Under The EU Cyber Resilience Act

RPC
RPC
Contributor
RPC

RPC

At RPC, we know you need more than top quality legal advice. You need relationships that empower...

View firm profile
Explore more from RPC

The EU Cyber Resilience Act introduces mandatory incident reporting obligations for manufacturers of products with digital elements, requiring them to notify authorities of actively exploited vulnerabilities and severe security incidents within strict timelines starting September 2026. Understanding the scope of these requirements, including which products qualify and what constitutes a reportable event, is critical for manufacturers to establish compliant reporting protocols before the deadline. This analy

European UnionMedia, Telecoms, IT, Entertainment
Jon Bartley
Jon Bartley
Sophie Hudson
Sophie Hudson

Background

The EU Cyber Resilience Act (the "CRA") imposes mandatory cybersecurity requirements on products with digital elements ("PDE") across their entire lifecycle. These cybersecurity standards are demonstrated through conformity assessments, technical documentation, and CE marking. 

The CRA complements the broader EU cybersecurity framework e.g. NIS2, EU GDPR and sector-specific rules. While NIS2 addresses the security of networks and information systems operated by service providers and is focused on specific verticals (e.g. cloud providers), the CRA is sector-agnostic and applies to networked products placed on the EU market. As a result it has a much broader application, particularly as "products" include standalone software such as mobile apps, not just hardware products. 

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Evolution Delivered: What Regulation (EU) 2026/2202 Means For EU261 Reform

The European Union has enacted its most comprehensive overhaul of passenger rights legislation in over twenty years, introducing significant operational changes for airlines while maintaining the core architecture of the existing compensation framework. With implementation required by October 2027, carriers face expanded obligations around automatic reimbursements, rerouting rights, and assistance provisions, alongside new clarity on extraordinary circumstances and claims procedures.
European UnionMedia, Telecoms, IT, Entertainment
Burges Salmon LLP
Burges Salmon LLP
Article

The EU Kids Act: Not Just A Social Media Ban, And Not Just An EU Problem

The European Commission has proposed the EU KIDS Act, a comprehensive regulation that extends far beyond a simple social media ban for under-13s. This ambitious framework introduces tiered age-based restrictions, safety-by-design obligations across digital services including AI chatbots and online games, and mandatory certified age-verification systems. With potential fines reaching 6% of global turnover and enforcement mechanisms piggybacking on existing DSA machinery, organisations offering digital servic
European UnionMedia, Telecoms, IT, Entertainment
Burges Salmon LLP
Burges Salmon LLP
Article

Manchester City Decision: A Landmark Moment For Sports Regulation

The independent Commission's findings against Manchester City FC for serious breaches of Premier League financial rules have sparked crucial debates about transparency, disciplinary processes, and the future of sports regulation. This landmark decision raises fundamental questions about how sporting bodies balance fairness, consistency, and regulatory discretion when enforcing financial compliance rules. The case's implications extend far beyond football, offering insights into regulatory frameworks, sancti
United KingdomMedia, Telecoms, IT, Entertainment
Olliers Solicitors
Olliers Solicitors
Article

EU Kids Act: What Do The Planned Age Restrictions And Safety Requirements For Minors Online Mean For Providers?

The European Commission has proposed the EU KIDS Act, introducing comprehensive restrictions on minors' access to social media and video-sharing platforms while imposing extensive online safety requirements across digital services. This landmark legislation will require businesses to implement safety-by-design frameworks, age verification systems, and guardian controls, with particularly stringent compliance obligations for Very Large Online Platforms that must prove their services are safe through independ
European UnionMedia, Telecoms, IT, Entertainment
Winston Taylor
Winston Taylor
Article

HFSS: ASA Rulings Provide Clarity On Where “brand Advertising” Ends And Product Advertising Begins

The UK's Advertising Standards Authority has issued new guidance on how it will enforce restrictions on advertising less healthy food and drink products online and on television. Through several July 2026 rulings involving major brands like M&M's, Domino's, and KFC, the ASA clarified when the 'brand advertising exemption' applies and when product imagery crosses the line into depicting specific restricted products.
United KingdomMedia, Telecoms, IT, Entertainment
RPC
RPC
Article

Woodville Collapse And Regulatory Reform – Litigation Funding In The Spotlight

The collapse of Woodville Consultants Ltd has exposed significant vulnerabilities in the rapidly expanding litigation funding market, which operates largely outside mainstream financial regulation. With nearly £300 million owed to retail investors and questionable lending practices to law firms, the case raises critical questions about investor protection, regulatory oversight, and the future balance of power in funded litigation.
United KingdomInsolvency/Bankruptcy/Re-Structuring
RPC
RPC
Article

HFSS: ASA Rulings Provide Clarity On Where “brand Advertising” Ends And Product Advertising Begins

The UK's Advertising Standards Authority has issued new guidance on how it will enforce restrictions on advertising less healthy food and drink products online and on television. Through several July 2026 rulings involving major brands like M&M's, Domino's, and KFC, the ASA clarified when the 'brand advertising exemption' applies and when product imagery crosses the line into depicting specific restricted products.
United KingdomMedia, Telecoms, IT, Entertainment
RPC
RPC
Article

IP Right Infringement By Re-posting Of Photographs On Social Media – Assessing Damages, Calculation Of Interest And Costs Recovery In The IPEC

A copyright infringement case in the Intellectual Property Enterprise Court examines how damages should be calculated when a defendant used thousands of photographs from Max Power magazine on social media to build a following and promote commercial events. The court's decision provides important guidance on determining reasonable licence fees for social media use and the application of IPEC's costs cap provisions.
United KingdomIntellectual Property
RPC
RPC
Article

UK ‘Windfall’ Bank Tax Would Worsen An Already Complex System

UK banks face the prospect of a new windfall tax as campaigners push for additional levies on strong reported profits, while industry leaders warn of potential consequences for lending, investment, and the UK's position as a global financial centre. This analysis examines the practical implications of adding another layer to an already complex sector-specific tax regime that includes corporation tax, banking surcharge, and bank levy.
United KingdomTax
RPC
RPC
Article

ASA Rulings Target Fashion Retailers’ Environmental Product Claims

The ASA's recent rulings against major fashion retailers Adidas, UNIQLO, and Calvin Klein reveal a strict regulatory stance on environmental claims, particularly regarding "recycled" and "organic" product descriptions. These decisions demonstrate that consumers interpret such terms as absolute claims about entire products, requiring comprehensive substantiation. Retailers must now carefully frame environmental claims with precise qualifications or risk regulatory action.
United KingdomConsumer Protection
RPC
RPC
Article

Supreme Court Restricts Contractor’s Right To Terminate For Repeated Employer Defaults

The Supreme Court examined whether a contractor could terminate a construction contract following two late payments by the employer, even though the first payment was made within the contractual cure period. The case centered on interpreting standard JCT contract termination provisions and whether a 'repeated default' clause required an earlier accrued right to terminate.
United KingdomLitigation, Mediation & Arbitration
RPC
RPC
Article

Tribunal Limits HMRC's Schedule 36 Powers In Transfer Pricing Case

When HMRC issued an information notice demanding a UK subsidiary's US parent company financial statements in a transfer pricing enquiry, the First-tier Tribunal had to determine whether such documents were reasonably required and whether the subsidiary had the power to obtain them. The case examines the boundaries of HMRC's information-gathering powers and the practical limits of corporate group relationships.
European UnionTax
RPC
RPC
Article

Online Safety Act: Ofcom Consults On Fraudulent Advertising Codes

Ofcom's draft Fraudulent Advertising Codes propose nearly 40 measures that large platforms and search services must implement to prevent UK users from encountering paid-for fraudulent adverts. The codes establish a layered "safety by design" approach spanning governance, advertiser integrity, moderation, reporting and transparency requirements. With potential fines reaching £18m or 10% of qualifying worldwide revenue, platforms face significant compliance obligations across onboarding, account security
United KingdomMedia, Telecoms, IT, Entertainment
RPC
RPC