The EU CRA's Real Question: What Shipped, and When Did You Know?
EU Cyber Resilience Act reporting requirements take effect Sept 11, demanding 24-hour vulnerability disclosures.
The EU Cyber Resilience Act (CRA) will soon require software vendors selling into the EU to report actively exploited vulnerabilities within 24 hours of discovery. This new regulation, effective September 11, 2026, shifts the burden from informal volunteer processes to legal obligations for many companies. The CRA also mandates current Software Bills of Materials (SBOMs), emphasizing the critical need for vendors to accurately track what software components have shipped and when vulnerabilities were identified.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ActiveState?
Get an email when a new story names ActiveState, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe EU Cyber Resilience Act (CRA), effective September 2026, transforms vulnerability disclosure from a voluntary best practice into a legal obligation, requiring vendors to report actively exploited vulnerabilities within 24 hours of discovery. Many organizations currently lack the internal processes, tooling, and supply chain visibility needed to meet this timeline consistently. The mandatory use of Software Bills of Materials (SBOMs) exposes a widespread gap: vendors often cannot accurately account for every component that has shipped in their products. Failure to comply carries significant legal and financial risk, making this a board-level concern rather than a purely technical one. Organizations that delay preparation will find themselves scrambling to retrofit compliance into immature vulnerability management programs.