Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 15 SEPTEMBER 2026

Cyber Resilience Act: New Vulnerability Reporting Requirements Now In Force

Browne Jacobson LLP
Browne Jacobson LLP
Contributor
Browne Jacobson LLP

Browne Jacobson LLP

We’re Browne Jacobson. The law firm for positive impact across business and society. Social and...

View firm profile
Explore more from Browne Jacobson LLP

The EU Cyber Resilience Act introduces mandatory reporting obligations for manufacturers of digital products, requiring them to notify authorities within 24 hours of discovering actively exploited vulnerabilities or severe security incidents. This regulation establishes strict timelines for early warnings, detailed vulnerability notifications, and final reports, fundamentally changing how manufacturers must respond to cybersecurity threats.

IrelandTechnology
Jeanne Kelly
Jeanne Kelly
Raymond Sherry
Raymond Sherry
Aisling Cowan
Aisling Cowan

As of 11 September 2026, manufacturers are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements.

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) (the 'CRA') is a piece of EU legislation establishing comprehensive cybersecurity requirements for digital products in the EU. The CRA imposes obligations on manufacturers, importers and distributors throughout the digital product lifecycle. It entered into force on 10 December 2024, with its provisions applying on a phased basis through to 11 December 2027.

Obligations from 11 September

The obligations which came into force on 11 September come from Article 14 of the CRA, which outlines the reporting obligations for manufacturers. Importantly, there is no grace period for these obligations coming into force. The obligation for in-scope digital products is to report:

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

EU Commission Publishes Cybersecurity And AI Action Plan

The European Commission has published an Action Plan addressing the dual-edged nature of frontier artificial intelligence models in cybersecurity, outlining how the EU will harness AI's defensive capabilities while protecting against AI-powered cyber threats. Through nine key actions spanning 2026-2027, the plan establishes frameworks for safe AI evaluation, structured access to advanced AI capabilities, and the scaling of European sovereign AI cybersecurity solutions across critical infrastructure sectors.
European UnionTechnology
Matheson
Matheson
Article

Time Running Out As AI Transparency Guidelines Published

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.
IrelandTechnology
William Fry LLP
William Fry LLP
Article

Irish Government Publishes The Regulation Of Artificial Intelligence Bill 2026

The Irish Government has published the Regulation of Artificial Intelligence Bill 2026, establishing Ireland's framework for implementing the EU AI Act. This landmark legislation creates the AI Office of Ireland as an independent statutory entity and designates existing sectoral authorities to oversee AI regulation within their domains. The Bill introduces a comprehensive administrative sanctions regime and enforcement toolkit while reflecting Ireland's National Digital and AI Strategy.
IrelandTechnology
Matheson
Matheson
Article

CJEU Clarifies The Limits Of The Hosting Safe Harbour For Online Platforms

The Court of Justice of the European Union has delivered landmark judgments that fundamentally reshape how online platforms can claim immunity from liability for user-generated content. These decisions establish that algorithmic content distribution and commercial partnerships with creators may strip platforms of their safe harbour protections, forcing a reassessment of how social media companies, video-sharing services, and digital marketplaces structure their operations and revenue models.
IrelandTechnology
Matheson
Matheson
Article

Ireland's Domestic AI Legislation Comes Into Force

Ireland has established the AI Office as its central coordinating authority under the EU AI Act, introducing a comprehensive regulatory framework that includes sector-based supervision, enforcement powers, and administrative fines reaching up to €35 million. The new legislation empowers market surveillance authorities like the Central Bank and Data Protection Commission to oversee AI compliance while creating a regulatory sandbox to foster innovation within legal boundaries.
IrelandTechnology
Arthur Cox
Arthur Cox
Article

The AI Digital Omnibus – Simplifying The Path To EU AI Compliance

The European Commission's AI Digital Omnibus proposes targeted amendments to the EU's AI Act, aiming to simplify compliance requirements and address implementation challenges while maintaining core safeguards. The revision extends timelines for high-risk AI systems and provides additional regulatory privileges for small and mid-cap enterprises navigating the world's first comprehensive horizontal legal framework for artificial intelligence.
IrelandTechnology
Matheson
Matheson
Article

The UK Cyber Security And Resilience Bill: What You Need To Know

The UK Government has introduced the Cyber Security and Resilience Bill to address critical gaps in existing cyber security regulations, expanding coverage to data centres, managed service providers, and critical suppliers while granting regulators enhanced enforcement powers. With tightened incident reporting deadlines, turnover-based penalties up to £17 million, and mandatory supply chain resilience measures, organisations across essential services sectors must assess their readiness for compliance
United KingdomTechnology
Browne Jacobson LLP
Browne Jacobson LLP
Article

Thirlwall Inquiry Report: Key Findings And What They Mean For NHS Patient Safety

After three years of evidence and testimony, Lady Justice Thirlwall has delivered a landmark report examining how Lucy Letby was able to murder seven babies and attempt to murder six others at the Countess of Chester Hospital. The findings reveal systemic failures in NHS governance, patient safety protocols, and leadership accountability that extend far beyond a single institution. NHS trusts now face fundamental questions about how they prioritize patient safety over reputation, respond to clinical warning
United KingdomFood, Drugs, Healthcare, Life Sciences
Browne Jacobson LLP
Browne Jacobson LLP
Article

Advertising In ChatGPT: What Retailers Need To Know

OpenAI's integration of advertisements into ChatGPT marks a significant shift in how retailers can reach consumers through conversational AI. As this emerging channel offers contextual relevance at moments of genuine purchasing intent, retailers must navigate complex advertising regulations, data protection requirements, and sector-specific rules to ensure compliance while capitalizing on this novel marketing opportunity.
United KingdomMedia, Telecoms, IT, Entertainment
Browne Jacobson LLP
Browne Jacobson LLP
Article

Six Minutes From Crisis To Covered: How Artificial Intelligence Is Transforming Pet Insurance Claims

Swedish Insurtech Lassie has launched in the UK with a revolutionary pet insurance model that combines AI-powered claims processing, gamified health rewards, and personalized pet care guidance through a single app. The platform promises to settle claims in just six minutes and offers a prevention-first approach that could fundamentally reshape the traditional pet insurance market. With over 20 million UK pets currently uninsured, Lassie's innovative approach may finally bridge the gap between pet owners and
United KingdomInsurance
Browne Jacobson LLP
Browne Jacobson LLP
Article

Unboxing The New EU Packaging Regulation

The EU Packaging Regulation introduces sweeping reforms to packaging and packaging waste legislation across all Member States, establishing requirements for the entire lifecycle of packaging from labelling to environmental sustainability. With ambitious targets to reduce packaging waste per capita by 15% by 2040 and mandatory recyclability standards taking effect from 2030, businesses involved in product packaging face significant compliance obligations that will fundamentally reshape how they design, manuf
European UnionEnvironment
Browne Jacobson LLP
Browne Jacobson LLP
Article

Key Legal And Policy Changes For Schools In 2026/27

As schools navigate the immediate pressures of 2025/26, several major legal and policy changes are already taking shape that will fundamentally reshape how schools operate from 2026/27 onwards. From the most significant employment law reforms in a generation to new AI regulations and the introduction of MAT-level Ofsted inspections, early preparation will be essential for school leaders who want to stay ahead of these transformative changes.
United KingdomEmployment and HR
Browne Jacobson LLP
Browne Jacobson LLP
Article

Inclusion Bases In Schools: What The 2026 Guidance Means For Your Autumn Term

September brings significant changes to the legal framework governing inclusion bases in schools. Two key documents published in 2026 reshape how schools must operate these provisions, introducing new statutory requirements for off-site directions, mandatory review processes, and clear expectations around reintegration planning. Schools and academy trusts need to understand what has changed and ensure their documentation and service level agreements are compliant before the autumn term begins.
United KingdomConsumer Protection
Browne Jacobson LLP
Browne Jacobson LLP