The EU CRA Will Make You Report What It Hasn't Yet Made You Fix
Summary: Under the EU Cyber Resilience Act, manufacturers selling products with digital elements into the EU must report actively exploited vulnerabilities to a regulator within 24 hours of learning of them, with a fuller account due at 72 hours, starting September 11. The regulation's essential cybersecurity requirements governing how products are designed and built do not apply until December 11, 2027, leaving a fifteen-month gap in which companies must disclose exploited vulnerabilities in products not yet subject to the engineering requirements.
What's compelling: For fifteen months, regulators will collect disclosure data on products that face no mandated security engineering, and the companies that struggle will be those that cannot say on demand what shipped in a product and when someone first knew of a problem - a gap that gets documented, with dates, and filed officially.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026