Cyber Resilience Act is here! Myth busting and first impressions

The EU Council adopted the Cyber Resilience Act, requiring manufacturers to adopt coordinated vulnerability disclosure, patch promptly, report actively exploited flaws to ENISA, and provide SBOMs.

The EU CRA's vulnerability reporting rules took effect on 11 Sept 2026: makers of digital products must report actively exploited vulnerabilities within 24h, facing fines up to EUR 15M.

The EU Cyber Resilience Act introduces mandatory vulnerability and incident reporting starting September 11, 2026. See key dates, reporting timelines, and how a VDP helps teams stay audit-ready.

The EU is adopting the Cyber Resilience Act, which will bring pivotal changes to product cybersecurity in Europe, the United States, and globally.

Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.

A crypto-asset service provider (CASP) is any business providing regulated crypto-asset services under the EU's MiCA framework. This guide covers qualifying activities and compliance obligations.