New Cyber Resilience Act rules take effect

Since September 11, 2026, a new stage of the Cyber Resilience Act (CRA) has become reality. Manufacturers of products with digital elements sold in the European Union must now report actively exploited vulnerabilities and serious security incidents affecting their products. These reports must be submitted through a centralized platform managed by ENISA, the European Union Agency for Cybersecurity.

Rapid reporting demands quick understanding

The CRA requires companies to issue an initial alert within 24 hours of discovering a vulnerability or incident, followed by a more detailed report within 72 hours. This tight timeline presents a significant challenge, as organizations must first quickly understand the situation before they can report it. This shift represents a major structural change, moving away from viewing regulation as a mere compliance task.

24 hours test of cyber visibility

The digital landscape of companies has expanded greatly in recent years, with elements like cloud services, third-party software, and remote users increasing complexity. This expansion means that companies cannot notify authorities within 24 hours if they take longer to understand the issue. The first requirement, therefore, is visibility—being able to quickly identify which systems, data, and users are affected by an incident.

Three key capabilities for effective response

The CRA pushes companies to focus on three core capabilities: see, understand, and act. See involves maintaining continuous visibility of digital environments and their dependencies. Understand means quickly determining the impact of a vulnerability or incident on applications, users, and data. Act requires having the technical and procedural tools to contain risks, isolate affected components, and notify authorities without delay.

Beyond regulation: a governance challenge

The CRA differs from NIS2, which focuses on cybersecurity for essential services, by establishing a broad cybersecurity framework for products containing digital elements. While the reporting requirements began in September 2026, most CRA rules will take effect in December 2027. Companies now face a period of adjustment, which they can view either as a regulatory challenge or an opportunity to improve their digital resilience.

Cyber maturity revealed by the 24-hour rule

The 24-hour deadline for reporting acts as a test of an organization's cyber maturity. Companies that can quickly understand incidents, identify affected systems, and take immediate action will be better prepared to meet regulatory requirements. In the long term, the CRA offers an opportunity to transform compliance into a result of improved digital management, ultimately increasing resilience against cyber threats.