CRA’s First Connected-Products Deadline Is in Less Than 100 Days

The EU Cyber Resilience Act's Article 14 takes effect September 11, 2026, requiring manufacturers of connected devices to notify EU regulators of actively exploited vulnerabilities within 24 hours, with a detailed follow-up within 72 hours and a final report within 14 days. This applies retroactively to all supported products in the EU market, regardless of when they were deployed. Most manufacturers are unprepared. Key steps include building SBOM-based supply chain visibility, establishing a formal vulnerability disclosure process with a named decision-maker, testing emergency patch workflows, and maintaining up-to-date customer contact data by market. Non-compliance carries penalties up to €15 million or 2.5% of global annual turnover. The author, from Finite State (which offers a managed CRA compliance service), argues that teams starting now can still meet the September deadline and gain a competitive advantage as similar regulations converge globally.

Source: https://www.embedded.com/cras-first-connected-products-deadline-is-in-less-than-100-days. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.