Prepare for the Cyber Resilience Act's 24-hour reporting deadline

Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively exploited. This is a new requirement under the Cyber Resilience Act ( CRA ), the EU law that sets cybersecurity requirements for products with digital elements sold in Europe, put in place to ensure those products are secure by design and supported against new threats.