Dec 11, 2027·EU Commission · Regulation (applies)ScheduledHigh impact
EU Cyber Resilience Act becomes fully applicable
The CRA's core obligations - secure-by-design, SBOM, vulnerability handling, and 24-hour incident reporting - apply to products with digital elements placed on the EU market. Devices regulated under the MDR or IVDR are excluded.
What changed
- Manufacturers must maintain an SBOM and a coordinated vulnerability disclosure policy for the product's support period.
- Actively exploited vulnerabilities and severe incidents must be reported via the single reporting platform (early warning within 24 hours of awareness); this applies from September 11, 2026.
- Products regulated under the MDR or IVDR are excluded (Article 2(2)); non-device products sold alongside them, such as wellness apps or general-purpose gateways, can be in scope.
Action for manufacturers
Decide per product whether CRA or MDR applies, then build the 24h incident reporting playbook now - the cadence is faster than FDA postmarket and many teams are not staffed for it.