In brief: CRA reporting obligations take effect on 11 September 2026, with product obligations following in 2027 – ENISA and BSI have published implementation documents on this.
From 11 September 2026, the first reporting obligations of the European Cyber Resilience Act (CRA) will apply, followed by the product obligations in 2027. ENISA and BSI have published documents on practical implementation.
The EU’s Cyber Resilience Act (CRA) is entering into force in stages. As early as 11 September 2026, manufacturers of products with digital elements will be required to report actively exploited vulnerabilities and serious security incidents to the competent authorities within specified deadlines. The actual product obligations – such as security-by-design, vulnerability management throughout the entire product lifecycle and CE marking – will then apply from 2027. ENISA has published a document intended to support companies in implementation; BSI is also providing accompanying materials.
For companies, this initially means clarifying their own scope of application: the CRA covers almost all products with digital elements that contain software or hardware with data-processing functions and are placed on the market in the EU. Both manufacturers as well as importers and distributors are affected. Anyone responsible as CISO for IT security within a company should assess early on which of their own or externally sourced products fall within scope, in order to set up reporting processes in good time before the September 2026 deadline.
The documents provided by ENISA and BSI offer concrete guidance on the classification of products, on reporting deadlines and channels, as well as on the technical requirements that will become mandatory from 2027. Since the transition periods are relatively tight, an early gap analysis against existing security and reporting processes within the company is advisable in order to identify the need for adjustments in good time.
Source: borncity.com · Published 16 August 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.