Hardware and software products are increasingly exposed to cyberattacks. From baby monitors and smartwatches to apps and computer programmes, products with digital elements are part of our daily lives. TheCyber Resilience Act (CRA)strengthens the cybersecurityof these products andbetter protects consumers and businesses from cyber threats.

As of 11 September 2026, manufacturers mustreportanyactively exploited vulnerabilities and severe incidentsthat have an impact on the security of their products. They mustsubmit an early warning within 24 hours, followed by a full notification within 72 hours. A final report must then be submitted no later than 14 days after a corrective or mitigating measure is available for an actively exploited vulnerability, and within 1 month for a severe incident.

In practice, this means consumers can rely on faster notifications and stronger protection for their connected devices, such as door locking systems, keeping their home safe and secure in the event of a cyberattack.

The reporting obligations apply toall products with digital elements made available in the EU, including those already on the market. Manufacturers will submit their notifications through the CRA Single Reporting Platform, established and maintained by theEuropean Union Agency for Cybersecurity.

The Commission publishedpractical guidanceto help manufacturers, developers, and businesses meet their obligations. National market surveillance authorities will ensure enforcement of the rules.

The Cyber Resilience Act builds on theEU cybersecurity strategyand theEU security union strategy. It aims tostrengthen the EU approach to cybersecurity. The new rules require products with digital elements to bedesigned,updated, andmaintainedtoprotect users from security risks. TheCE markingwill help them identify products that comply with the CRA requirements.

The main obligations introduced by the Act will apply from 11 December 2027, while the reporting obligations apply from 11 September 2026.