Cyber Resilience Act: The September 11, 2026 Deadline
Most Companies Are Missing
Most organizations believe they have until December 2027 to comply with the Cyber Resilience Act. That assumption is wrong. The first hard deadline is September 11, 2026 — five months from today. From that date, every manufacturer of products with digital elements sold in the EU must report actively exploited vulnerabilities within 24 hours. This applies to products already on the market, including software you shipped years ago. Unlike the EU AI Act, no extension has been proposed.
Key Facts
→September 11, 2026: Vulnerability reporting obligations begin. Not December 2027.
→24 hours: Early warning to ENISA and national CSIRT after discovering an actively exploited vulnerability.
→72 hours: Full notification with technical details.
→14 days: Final report after a corrective measure is available.
→Retroactive: Applies to all in-scope products already on the EU market — not just new products.
→Up to €15M or 2.5% of global annual turnover for non-compliance.
→No extension proposed. The Digital Omnibus does not affect CRA timelines.
What is the Cyber Resilience Act?
The Cyber Resilience Act (Regulation (EU) 2024/2847) establishes mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU. It entered into force on December 10, 2024 and covers the entire product lifecycle — from design through end-of-life.
The scope is broad: any software or hardware product that connects directly or indirectly to a device or network falls under the CRA. This includes IoT devices, desktop software, mobile apps, SaaS components, embedded systems, industrial control systems, and networking equipment. Exceptions exist for products governed by sector-specific regulations like medical devices, aeronautical equipment, and vehicles.
Unlike the EU AI Act, which focuses on a specific technology category, the CRA applies to virtually every digital product on the EU market. If you sell software or connected hardware into the EU, this regulation applies to you.
The three CRA deadlines
| Date | What applies | Status |
|---|---|---|
| Jun 11, 2026 | Conformity assessment bodies must be designated by national authorities | 2 MONTHS |
| Sep 11, 2026 | Vulnerability and incident reporting obligations begin | 5 MONTHS |
| Dec 11, 2027 | Full CRA compliance required. CE marking mandatory for new products. | 20 MONTHS |
Source: Regulation (EU) 2024/2847, Article 71. European Commission CRA implementation page.
What September 11 actually requires
From September 11, 2026, manufacturers must report two categories of events through the ENISA Single Reporting Platform:
1. Actively exploited vulnerabilities
A vulnerability is "actively exploited" when there is reliable evidence that a malicious actor has used it in a system without the system owner's permission. This includes vulnerabilities disclosed publicly or reported online.
2. Severe security incidents
Any incident that impacts the security of the product with digital elements. Same reporting cadence: 24 hours early warning, 72 hours full notification, final report within one month.
Why this catches companies off guard
It applies retroactively to products already on the market
The reporting obligation covers all in-scope products currently on the EU market, not just products placed after the CRA entered into force. Software you shipped in 2020 is subject to these requirements if it's still available and in use.
You cannot report what you cannot identify
To report an exploited vulnerability within 24 hours, you need to know which components are in your products. That requires a Software Bill of Materials (SBOM). The CRA explicitly mandates SBOMs (Annex I, Part II), but the practical reality is that SBOM readiness is required by September 2026 — not December 2027 — because you cannot comply with reporting without it.
The Digital Omnibus does not affect CRA timelines
The Digital Omnibus on AI proposes extending the EU AI Act's high-risk deadline to December 2027. It does not propose any changes to CRA deadlines. The September 11, 2026 reporting obligation is fixed.
Product classification has additional earlier deadlines
Beyond reporting, certain product categories have compliance dates before the December 2027 full application: horizontal type A products must comply by August 30, 2026, and horizontal type B and vertical type C products by October 30, 2026.
What you need in place by September
CRA compliance timeline at a glance
How AI Attest helps with CRA compliance
AI Attest includes a complete Cyber Resilience Act compliance pipeline with 11 artifacts covering product security description, security risk assessment, secure development lifecycle, vulnerability management, incident response, SBOM, technical documentation, and user information — all mapped to specific CRA requirements.
The platform's dependency tracking ensures your vulnerability management documentation stays consistent with your product security description and risk assessment. When your architecture changes, cascade invalidation flags every downstream document that needs updating. Every submission is recorded in a SHA-256 hash-chained audit trail — evidence that your compliance process was followed.
September is closer than December
Start your CRA compliance documentation now. Upload your existing security documentation and see where the gaps are. Free during beta.
Start your free compliance auditRelated
What the Digital Omnibus means for your AI Act compliance timeline.
EU AI Act Compliance Guide — Articles 9-17 →Article-by-article breakdown of 68+ requirements for high-risk AI systems.
How AI Attest works →Gap analysis, guided templates, cascade invalidation, and cryptographic audit trails.