EU Cyber Resilience Act

The reporting obligations under the EU Cyber Resilience Act take effect in September 2026, requiring manufacturers of products with digital elements to notify authorities of actively exploited vulnerabilities and security incidents. Companies selling connected hardware and software in the EU are preparing compliance processes ahead of the deadline, with legal commentators flagging the timeline for firms still assessing their obligations.