EU Cyber Resilience Act triggers mandatory security incident reporting

The European Union’s Cyber Resilience Act (CRA) has entered a critical implementation phase following the commencement of mandatory reporting obligations on September 11, 2026. This milestone requires manufacturers of connected or digital products to notify the European Union Agency for Cybersecurity (ENISA) within 24 hours of discovering an actively exploited vulnerability or a severe security incident.

Under these rules, the reporting clock begins as soon as a manufacturer becomes aware of the issue, regardless of whether a patch is ready. The obligation specifically targets incidents involving malicious code or those impacting the confidentiality, integrity, or availability of a product. For consumers, the regulation aims to ensure greater transparency, requiring manufacturers to provide clear information regarding security support periods, which should generally last at least five years.

In response to these requirements, DEKRA has obtained accreditation from the Dutch National Accreditation Council (RvA) to provide certification services under the CRA. This includes both Module B (conformity assessment of specific product types) and Module H (full quality assurance covering design, development, and production). These services are intended to help manufacturers, including those in the ICT, industrial, and automotive sectors, establish the technical evidence and compliance processes necessary to maintain access to the EU market.