Cybersecurity Policy Report, EU Prepares to Enforce Cyber Resilience Act With ‘Single Reporting Platform’, (Sep 11, 2026)
A “single reporting platform” (SRP) was unveiled today to simplify compliance with the European Union’s Cyber Resilience Act (CRA), parts of which became enforceable today.
Starting today, manufacturers of some software and connected devices are required to report “any actively exploited vulnerabilities and severe incidents that have an impact on the security of their products,” the European Commission noted in a news release.
The SRP developed by the EU Agency for Cybersecurity (ENISA) will give manufacturers a single platform for submitting the required reports. “Designed to support effective vulnerability management across the EU, the SRP allows users to report once and communicate the relevant information to all appropriate authorities,” ENISA said in a news release.
Under the CRA, manufacturers that become aware of a cyber vulnerability or incident have 24 hours to submit an initial report followed by a “full notification” within 72 hours, the EC noted. “A final report must then be submitted no later than 14 days after a corrective or mitigating measure is available for an actively exploited vulnerability,” it said.
“In practice, this means consumers can rely on faster notifications and stronger protection for their connected devices, such as door locking systems, keeping their home safe and secure in the event of a cyberattack. The reporting obligations apply to all products with digital elements made available in the EU, including those already on the market,” it said.
“Hardware and software products are increasingly exposed to cyberattacks,” the EC added. “From baby monitors and smartwatches to apps and computer programmes, products with digital elements are part of our daily lives. The Cyber Resilience Act (CRA) strengthens the cybersecurity of these products and better protects consumers and businesses from cyber threats.”
News: InternationalLegislation DataSecurity