EU Cyber Resilience Act mandates vulnerability reporting

The European Union’s Cyber Resilience Act (CRA) establishes cybersecurity standards for manufacturers and suppliers of products with digital elements, including IoT devices, industrial control systems, and smart cards. While the full regulation becomes applicable on 11 December 2027, mandatory reporting requirements for “actively exploited vulnerabilities” and “severe incidents” went into effect on 11 September 2026.

Under these rules, manufacturers must provide an early warning notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting product availability, authenticity, integrity, or confidentiality.

In response to these regulatory shifts, Green Hills Software has launched its Platform for CRA. The platform is designed to help manufacturers comply with the regulation through security-by-design principles, vulnerability handling, and secure updates. It utilizes the INTEGRITY real-time operating system to assist in meeting requirements such as Software Bill of Materials (SBOM) management and third-party component security.