Manufacturers must report cyber risks in any EU digital products from September

Organisations supplying software, connected devices and other digital products into the EU should be aware that the first obligations under the EU Cyber Resilience Act (CRA) take effect on 11 September 2026.

While the CRA's wider cybersecurity and product compliance requirements do not apply until December 2027, the reporting regime comes into force much earlier and applies to products already on the market.

The CRA introduces a new EU-wide framework designed to improve the cybersecurity of products with digital elements. It applies to a broad range of software and hardware capable of connecting directly or indirectly to a network, from consumer devices and industrial systems to enterprise software. The legislation places obligations directly on manufacturers, importers and distributors, including organisations based outside the EU that supply products into the EU market.

From 11 September 2026, manufacturers must notify the relevant national Computer Security Incident Response Team (CSIRT) and ENISA within 24 hours of becoming aware of an actively exploited vulnerability or a severe cybersecurity incident affecting a product. Manufacturers must also inform affected users in a timely manner and provide details of any mitigating measures or security updates that are available.

These obligations are significant because they apply regardless of whether any personal data has been compromised and may require reports in circumstances where no customer harm has yet occurred. They also apply to products already on the EU market before 11 September 2026 and so have retrospective application. Businesses caught by the CRA should therefore ensure that their vulnerability management, incident detection, escalation and regulatory reporting processes are capable of meeting the new deadlines.

Although the broader CRA requirements remain some distance away, organisations should also use this period to assess whether their products fall within scope, identify who within the supply chain will assume responsibility under the regime, and begin reviewing product security documentation, risk assessments and vulnerability management procedures.

You can read our full analysis of the CRA, including its scope, compliance requirements, enforcement regime and implementation timetable here.

If you would like advice on whether your products are caught by the CRA or how to implement the mandatory reporting obligations, please contact a member of our Digital team above.