EU Cyber Resilience Act Reporting Starts Before Its Product Security Requirements

Summary

The article argues that the EU Cyber Resilience Act's vulnerability-reporting requirement will take effect before its product cybersecurity requirements, exposing whether manufacturers can identify what they ship and when they learn of vulnerabilities.

Key points

• From September 11, 2026, manufacturers must notify regulators within 24 hours after learning that a vulnerability in a product sold in the EU is actively exploited, with a fuller account due within 72 hours.
• The Act's essential cybersecurity requirements for product design and development do not apply until December 11, 2027, leaving a 15-month gap.
• The author argues that reporting will improve regulators' visibility into software vulnerabilities but does not itself ensure manufacturers can prevent or fix them.
• A key organizational weakness is the inability to quickly establish what shipped in a product and when the company first knew of a vulnerability.
• The article urges boards to assess those ongoing capabilities rather than focus only on whether the company can file reports on time.
• The author recommends treating software provenance as a continuously funded operational capability, built into development rather than assembled after a problem arises.

Vendors

Industries