Manufacturers selling connected products in the European Union face a new legal duty starting Sept. 11. Report actively exploited vulnerabilities to authorities within 24 hours of confirming them. The obligation arrives 15 months ahead of the Cyber Resilience Act's full application date of Dec. 11, 2027, making it the regulation's first hard deadline.
The CRA covers products with digital elements placed on the EU market, a category broad enough to take in enterprise software, consumer IoT devices, industrial controllers and much of the component software beneath them.
Under Article 14, manufacturers must file an early warning within 24 hours of becoming aware of an actively exploited vulnera...