On 27 July 2026, the European Commission published its guidance on the Cyber Resilience Act (Regulation (EU) 2024/2847). Most CRA obligations don't come into force until December 2027, but the reporting duties start much sooner, and they cover products with digital elements already on the market today, not just future launches. September 11th 2026 From September 11th 2026, manufacturers must report to ENISA (European Union Agency for Cybersecurity) and the coordinating CSIRT
