EU Cyber Resilience Act's New Vulnerability And Incident Reporting Requirements For Products With Digital Elements Entered Into Force

Effective September 11, 2026, manufacturers of in-scope products with digital elements will be subject to incident and vulnerability reporting requirements under the EU Cyber Resilience Act (CRA). The CRA established a new EU-wide, product-focused cybersecurity framework, shifting regulatory attention beyond an organization's corporate network and cloud environment to the cybersecurity of the hardware, software, firmware, and connected products that companies place on the EU market. Specifically, the CRA establishes harmonized EU rules for placing connected hardware and software products on the market, imposes mandatory cybersecurity requirements on those products, and creates corresponding obligations for every actor across the value chain. While most CRA obligations will not enter into application until December 11, 2027, this incident and vulnerability reporting requirement is one of the first to take effect.