Share on LinkedInShare on LinkedIn

ARTICLE · 25 SEPTEMBER 2026

EU Cyber Resilience Act: First Reporting Obligations Take Effect Today

Slaughter and May
Slaughter and May
Contributor
Slaughter and May

Slaughter and May

Slaughter and May is an international full-service law firm, trusted by leading businesses and...

View firm profile
Explore more from Slaughter and May

The EU Cyber Resilience Act introduces mandatory reporting obligations for manufacturers of digital products starting September 11, 2026. What vulnerabilities and incidents must be reported, how quickly must notifications be made, and what are the consequences for non-compliance? Understanding these requirements is crucial for manufacturers and their customers as the regulatory landscape for cybersecurity evolves.

European UnionTechnology
Anton Hammer
Anton Hammer
Natalie Donovan
Natalie Donovan

On 11 September 2026 the reporting obligations under the EU Cyber Resilience Act (“CRA”) will take effect. While the CRA's principal requirements and obligations will not apply until December 2027, from today manufacturers of in-scope products will need to report any vulnerabilities in their products which have been actively exploited and/or severe incidents impacting the security of that product. 

The Commission has also recently published guidance and a set of FAQs to help organisations comply with these obligations and the upcoming requirements under the CRA.

Here we ask some key questions about the CRA and the reporting obligations that are coming into force. 

  1. What does the CRA Cover?

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

EDPB统一DPIA模板落地：欧盟数据合规正从“程序评估”走向“设计问责”

The European Data Protection Board has released a unified DPIA template for public consultation, marking a significant shift from fragmented national practices to coordinatead EU-wide compliance. This standardization effort aims to transform data protection impact assessments from procedural documents into substantive design accountability tools, requiring organizations to demonstrate not just that they conducted assessments, but that their processing activities can withstand rigorous evaluation.
European UnionTechnology
Jincheng Tongda & Neal
Jincheng Tongda & Neal
Article

The UK Cyber Security And Resilience Bill: What You Need To Know

The UK Government has introduced the Cyber Security and Resilience Bill to address critical gaps in existing cyber security regulations, expanding coverage to data centres, managed service providers, and critical suppliers while granting regulators enhanced enforcement powers. With tightened incident reporting deadlines, turnover-based penalties up to £17 million, and mandatory supply chain resilience measures, organisations across essential services sectors must assess their readiness for compliance
United KingdomTechnology
Browne Jacobson LLP
Browne Jacobson LLP
Article

Using AI In Recruitment: How To Avoid Discrimination Claims

Recruitment is one of the highest-risk areas for AI use in any organisation. It is also one of the areas where AI tools are being adopted most quickly, often with little scrutiny of what they actually do or how they reach their conclusions. The combination of speed, apparent objectivity, and legal exposure makes this a topic that HR professionals and employers cannot afford to approach without a clear understanding of the risks involved.
United KingdomTechnology
Buckles Law
Buckles Law
Article

Takeover Trends In 2026

The UK public M&A market in 2026 has already surpassed 2025's total value in just eight months, driven by large-cap deals and a quest for transformational scale. Hostile tactics have become increasingly prominent as bidders appeal directly to shareholders amid persistent valuation gaps, while target boards leverage pre-offer processes to maximize value. This analysis examines the key trends, strategic themes, and tactical developments shaping this remarkable year for UK takeovers.
United KingdomCorporate/Commercial Law
Slaughter and May
Slaughter and May
Article

Employment Bulletin - September 2026

The UK Government is consulting on sweeping reforms to equal pay law that would introduce mandatory pay transparency in job adverts, reinstate statutory questionnaires for discrimination disputes, and create a new enforcement unit with investigative powers. These proposals, alongside recent tribunal decisions on union inducements, restrictive covenants, and discrimination protections, signal a fundamental shift in how employers must approach pay equity and workforce management.
United KingdomEmployment and HR
Slaughter and May
Slaughter and May
Article

Corporate Update Bulletin - 3 September 2026

This Corporate Update bulletin examines the most significant UK legal developments of 2026, from capital markets reform and employment rights legislation to corporate criminal liability expansion and competition regime changes. The analysis covers ten major areas of corporate law evolution, alongside recent FCA guidance on regulatory announcements and a High Court decision on shareholder-director settlements.
United KingdomCorporate/Commercial Law
Slaughter and May
Slaughter and May
Article

Financial Regulation Weekly Bulletin - 10 September 2026

This weekly bulletin examines critical developments in UK financial regulation, including the FCA's findings on systemic operational resilience from its Defence, Security, and Resilience Lab exercise, the government's comprehensive consultation on modernising corporate reporting frameworks, and progress on the Financial Services and Markets Bill through Parliament. The bulletin also covers international regulatory updates on cyber resilience for financial market infrastructures, sustainable finance disclosu
United KingdomFinance and Banking
Slaughter and May
Slaughter and May
Article

AI Hallucinations Reach The Solicitors Disciplinary Tribunal

The Solicitors Disciplinary Tribunal has issued its first ruling on AI-generated false citations, striking off a lawyer who submitted fabricated case law to the court. This landmark decision establishes that existing professional standards apply to AI-assisted work, with no special leniency for technological errors. The tribunal's reasoning clarifies critical duties lawyers owe to courts when using AI tools in litigation.
United KingdomLaw Practice Management
Slaughter and May
Slaughter and May
Article

High Court’s Emma Sleep Judgment Offers Insights Into Misleading Reference Prices

The High Court has rejected the CMA's proposed fixed volume requirement for reference pricing in retail discounting, ruling that a mandatory 1:2 ratio between full-price and discounted sales was unworkable and failed to account for the average consumer's perspective. This landmark judgment in the Emma Sleep case provides crucial guidance for all businesses using "was/now" pricing strategies and reference pricing in their promotional activities.
United KingdomConsumer Protection
Slaughter and May
Slaughter and May
Article

“Pay To Stay”: Ofgem’s Plan To Cull The Data Centre Connection Queue

Ofgem's proposed data centre connection reforms introduce substantial upfront commitment fees ranging from £237,500 to £712,500 per MW and stringent queue management milestones for projects seeking grid connections. Will these measures successfully eliminate speculative projects while preserving viable data centre developments, or will they drive investment away from the UK entirely?
United KingdomEnergy and Natural Resources
Slaughter and May
Slaughter and May
Article

A Precedent For The Platform Age: The Booking/eTraveli Judgment And Its Implications For Digital M&A

The European General Court has upheld the Commission's prohibition of Booking's acquisition of eTraveli Group, endorsing a novel 'ecosystem' theory of harm that allows intervention even where market share increases are minimal. This landmark ruling significantly expands the Commission's ability to challenge acquisitions by dominant firms in digital markets, establishing that transactions which merely perpetuate existing low levels of competition can constitute significant impediments to effective
United KingdomAntitrust/Competition Law
Slaughter and May
Slaughter and May