Topic starter
18/08/2026 2:10 pm
TL;DR: The EU Cyber Resilience Act is already in force, but its obligations phase in across 2026 and 2027, with vulnerability reporting due in September 2026 and full conformity, including CE marking, due in December 2027, according to FOSSA. The practical risk is timeline compression: reporting workflows, SBOM generation, secure-by-design defaults, and lifecycle security controls all need to be operational before enforcement arrives.
Editorial analysis by NHI Mgmt Group, based on content published by FOSSA: “EU CRA Compliance Timeline: Key Dates and Deadlines”.
Key questions
Q: What breaks when CRA reporting is not operational before 2026?
A: Teams lose the ability to produce a defensible report inside the first deadline window, because they still need to identify affected products, confirm exploitation, gather evidence, and route approvals.
Q: Why does the Cyber Resilience Act create a bigger governance problem than a compliance deadline?
A: Because the regulation depends on repeatable product security operations, not one-off attestations.
Q: How do security teams know whether CRA readiness is real?
A: Look for whether the last shipped features can be traced to clear design decisions, not just to test results or ticket comments.
Practitioner guidance
- Define the CRA ownership model Assign a named owner for reporting, product security evidence, and conformity coordination so the 2026 and 2027 obligations do not sit in separate silos.
- Publish a coordinated vulnerability disclosure policy Stand up a public CVD policy now so security issues can move from discovery to ENISA-ready reporting without governance delays.
- Test the 24-hour early warning workflow Run tabletop exercises that start from first awareness of active exploitation and end with a complete notification package for ENISA and the national CSIRT.
Bottom line: The Cyber Resilience Act is phased, so the main risk is not ignorance of the law but failure to operationalise reporting and product controls before the deadlines.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:03 pm
The CRA turns product security governance into a deadline-driven control problem. Organisations often talk about compliance as a documentation exercise, but this regulation makes reporting, disclosure, and lifecycle security measurable obligations. The practical consequence is that product security teams need repeatable processes before enforcement dates, not ad hoc remediation after them. For practitioners, the programme question is whether security evidence can be generated as part of normal delivery.
A question worth separating out:
Q: Which matters more for CRA compliance, reporting readiness or product conformity?
A: Both matter, but reporting readiness has to come first because it tests whether the organisation can operate under regulatory time pressure. Full conformity covers the broader product lifecycle, yet the 2026 reporting mandate exposes whether incident handling, inventory, and escalation paths are already mature enough to support the 2027 regime.
👉 Read our full editorial: EU Cyber Resilience Act timelines: what practitioners must prioritise