EU's Cyber Resilience Act: The Clock Is Ticking

In September 2026, new obligations under the Cyber Resilience Act ("CRA") will begin to take effect, with the regulation applying in full from 11 December 2027, following its entry into force on 10 December 2024. As a European Union ("EU") regulation with extraterritorial effect, it also imposes these obligations on Swiss manufacturers, software providers and distributors, requiring them to ensure compliance whenever their digital products are offered, supplied or distributed within the EU or European Economic Area ("EEA").

From 11 September 2026, the first binding obligation for manufacturers takes effect, notably the mandatory reporting of actively exploited vulnerabilities (i.e., digital product flaws already exploited by malicious actors in real-world attacks) and severe security incidents. Separately, affected Swiss companies will be re quired to systematically review and align their product security, development processes, supply-chain governance, and