Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 21 SEPTEMBER 2026

Preparing For The EU Cyber Resilience Act: Key Reporting Obligations From 11 September 2026

Goodwin Procter LLP
Explore more from Goodwin Procter LLP

The EU's Cyber Resilience Act introduces mandatory cybersecurity reporting obligations for manufacturers of digital products starting September 2026, requiring notification of actively exploited vulnerabilities and severe incidents within strict timeframes. Companies must establish procedures to identify and report security events to national Computer Security Incident Response Teams, with potential fines reaching €15 million or 2.5% of global turnover for non-compliance.

United KingdomStrategy
Curtis McCluskey
Curtis McCluskey

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, adopted on 23 October 2024, aims to strengthen the cybersecurity of “products with digital elements”. The CRA applies to hardware and software products made available on the EU market whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network.

The legislation responds to the growing number of cyberattacks targeting hardware and software, many of which contain vulnerabilities that are not adequately addressed through cybersecurity measures or timely security updates. Its main objectives are to ensure that products with digital elements are secure by design and remain resilient against cyber threats throughout their life cycle, while providing users with clear information that enables them to consider cybersecurity when selecting and using products.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

See more popular content from

Article

European Commission Proposes European Innovation Act

The European Commission has unveiled a European Innovation Act designed to strengthen the EU's innovation ecosystem by addressing two critical challenges: limited access to finance for IP-rich businesses and fragmented regulatory frameworks across Member States. The proposal introduces measures including a common IP valuation framework, streamlined R&D procurement procedures, and harmonized regulatory sandboxes to help startups and scaleups commercialize their innovations more effectively.
European UnionStrategy
Lewis Silkin
Lewis Silkin
Article

The SRA’s AI Warning Notice: A Regulatory Wake-up Call, Not A Reason To Step Back

The Solicitors Regulation Authority has issued a warning notice on AI misuse in legal practice, clarifying what responsible adoption looks like. While recognizing AI's benefits for document review, drafting, and research, the regulator emphasizes that solicitors remain accountable for their work regardless of the tools used, requiring proper governance, human oversight, and professional judgment to manage risks like hallucinated citations and confidentiality breaches.
United KingdomStrategy
Gateley Legal
Gateley Legal