Cyber Resilience Act: reporting obligations apply from 11 September 2026

2026-09-11 · Publisher : Union européenne · Domain : Cloud & DevOps

On 11 September 2026, the Cyber Resilience Act's reporting obligations apply: manufacturers must report actively exploited vulnerabilities and serious incidents affecting their digital products.

### Background On 11 September 2026, the first application milestone of the European Cyber Resilience Act (CRA) arrives: manufacturers of products with digital elements must report actively exploited vulnerabilities and incidents. The regulation, in force since 10 December 2024, then rolls out until 11 December 2027, when the main obligations apply. ### Key facts - Entry into force: 10 December 2024; reporting of exploited vulnerabilities and incidents: 11 September 2026; main obligations: 11 December 2027. - The regulation requires security by design, maintenance and updating of products, vulnerability management throughout their lifecycle and CE marking. - Some high-risk products require assessment by a notified body; specific provisions concern open source software contributors. - Supply chain tooling vendors, such as JFrog, already offer ready-made CRA compliance frameworks. - Each Member State's market surveillance authority checks enforcement; JFrog cites fines of up to €15 million or 2.5% of global turnover. ### Why it matters For consulting firms and their software-vendor or industrial clients, reporting becomes an operational capability to build: detecting an exploited vulnerability, qualifying its impact on each product and sending the report within the required deadlines. It rests on component inventory, traceable build pipelines and incident response processes, hence the direct link with the supply chain attacks of 2024 to 2026. ### Takeaway CRA compliance starts with reporting: component inventory and incident response must be in place before 2027.

Tags : Réglementation, Europe, Sécurité, CI/CD