CRA reporting and digital products in the EU
Cyber Resilience Act reporting duties began to apply before the main obligations stated for 2027.
In brief
The European Commission states that, from 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products. [claim-reg-cra] The AI Omnibus is a separate example of a regulatory timeline change for AI. [claim-reg-ai]
- CRA reporting applies to products with digital elements made available in the EU. [claim-reg-cra]
- The Commission describes a 24-hour early warning and a 72-hour full notification. [claim-reg-cra]
- The two regimes have different objects and timelines and should be tracked separately. [claim-reg-separar]
CRA reporting
The supplied Commission information describes reporting deadlines and places the reporting obligations’ application date at 11 September 2026. [claim-reg-cra]
Separate timelines
The AI Omnibus communication states milestones for high-risk AI categories that are distinct from CRA cybersecurity reporting. [claim-reg-ai]
Limits and review condition
This is an informational EU summary, not legal advice or an applicability determination. Review it if later official guidance, product changes, or vulnerability facts arise. [claim-reg-cra]
Sources consulted
Consulted on the stated update date.
Opens in a new window.Participate
Share the analysis. Add context.
Distribute the article through your channel or leave an observation connected to the topic.
Comments
Loading the conversation.