Platform & Regulatory Announcements
Stay informed on Cyber Resilience Act milestones, regulatory guidelines, and platform updates.
Looking for press coverage from around the web? CRA News →
The ENISA Single Reporting Platform opened on 11 September 2026, the day Article 14 reporting entered application. Manufacturers file actively exploited vulnerabilities and severe incidents through it, and ENISA advises registering only when a notification is due.
Wave 2 of the CRA Exposure Study re-scanned the same 342 manufacturers after Article 14 started to apply. Valid security contacts rose from 7.0% to 9.6%.
Article 14(7) fixes one electronic notification end-point per manufacturer, set by the Member State of main establishment. Article 16(1) lets Member States and ENISA each run their own end-point, so a national reporting portal is part of the single reporting platform.
No. ETSI opened the approval procedure for 17 vertical Cyber Resilience Act standards on 13 August 2026, and the Official Journal has cited none of them. Presumption of conformity under Article 27 starts at citation, not at approval.
A CRA compliance platform manages Cyber Resilience Act duties and replaces a hosted policy page, shared intake inbox, tracking spreadsheet, deadline reminders, bespoke advisories, and technical file folder tree.
The company placing the finished product on the market files the Article 14 report, including for a vulnerability that originates in a component it bought. Article 13(6) adds a second report to whoever maintains that component.
Nemko Group designated South Korea's Telecommunications Technology Association (TTA) as a Notified Body Test Laboratory (NBTL), enabling local CE cybersecurity testing for manufacturers exporting to the EU.
CVD Portal is now publicly listed on the Cloud Security Alliance STAR Level 1 registry with a completed CAIQ v4.0.2 self-assessment covering all CCM domains.
The GCVE registry now lists CVD Portal as GNA 126. The registration is live. The allocation service, retrieval API, and data dump are planned and are not yet live.
ENISA published its 5-year cybersecurity assessment report (2021-2025). The data confirms SOG-IS certificate issuance ended in February 2026, EUCC launched with 24 accredited laboratories, and CEN/CENELEC EN 17640 (FiTCEM) established fixed-time SME testing across the EU.
Filing an Article 14 notification requires an EU Login account, your coordinating CSIRT has to validate your reporters after you first sign in, and ENISA has confirmed there will be no submission API. All three have lead times, and the platform opens on the same day the 24-hour clock starts.
Twenty-two playbooks covering secure by design and secure by default across a product life cycle, aimed at SMEs and published on GitHub under CC BY 4.0. It is ENISA guidance rather than a harmonised standard, so applying it confers no presumption of conformity.
Version 2.1 replaces the 2021 NTIA baseline and takes the field count from seven to seventeen. It is not Union law. Seven EU national cybersecurity agencies co-authored it anyway, so expect procurement to follow it, and an SBOM built to the CRA floor fails it by construction.
ETSI TC CYBER has published draft Cyber Resilience Act standards for anti-malware software, firewalls, routers, hypervisors and other Annex III product categories, the first of 18 product-specific deliverables under standardisation request M/606.
C(2026) 5252 sets out the Commission's own reading of the CRA across 84 pages and 67 worked examples. It defines when the Article 14 reporting clock starts, gives a four-factor test for substantial modification, and confirms that five years of support is a floor rather than a default.
Article 31(2) requires the technical file to be continuously updated during the support period, Article 13(3) puts the same clock on the risk assessment, and Article 28 keeps the Declaration of Conformity current. A new walkthrough covers the update duties, the trigger events and a review cadence that holds up.
CISA, NSA, JPCERT/CC, NCSC-NL, and NCSC-UK published a joint guide on establishing a coordinated vulnerability disclosure programme. It names the EU Cyber Resilience Act directly.
CISA, NSA, JPCERT/CC, NCSC-NL and NCSC-UK released joint guidance on building a coordinated vulnerability disclosure program. We mapped every recommendation against CVD Portal.
The CRA requires a coordinated vulnerability disclosure policy, a bug bounty is optional. Our new guide explains how the two approaches relate and how AI triage keeps up when report volume grows.
CVD Portal will be at GITEX AI Europe in Berlin on 30 June and 1 July 2026, stand H2.2-B90 at Messe Berlin. Come see how manufacturers run Coordinated Vulnerability Disclosure and meet the EU Cyber Resilience Act reporting obligations that start applying on 11 September 2026.
A European Commission Delegated Regulation published in December 2025 specifies when a coordinating CSIRT may delay onward distribution of a manufacturer's CRA notification on security grounds. The mechanism shapes how sensitive reports move through ENISA's Single Reporting Platform.
The Netherlands missed the NIS2 transposition deadline by nearly two years. The Cyberbeveiligingswet has now cleared the House of Representatives and the government is targeting entry into force on 1 July 2026, with no grace period and personal liability for directors. Our latest piece walks Dutch executives through the four obligations that change how boards operate.
A single exploited flaw can start a CRA early warning, a NIS2 significant-incident notification and a GDPR breach report at once, each on its own deadline and to its own authority. Our latest piece maps where the obligations overlap and where they diverge.
The German Engineering Federation (VDMA) has published its CRA Vulnerability Handling Guideline, providing industrial machinery manufacturers with an actionable blueprint for prEN 40000-1-3 compliance and mandatory Article 14 reporting.
In a Help Net Security interview, Nuno Rodrigues Carvalho, Head of Sector for Incident and Vulnerability Services at ENISA, addressed the recent CVE funding scare, EU regulatory enforcement, and why vulnerability disclosure is becoming a co
The EU Cyber Resilience Act is becoming a primary driver of security investment decisions across Europe.
As the European Union continues to strengthen its digital market, stakeholders are reminded that the first critical compliance milestone of the Cyber Resilience Act (CRA) is approaching. Effective 11 September 2026, manufacturers of product
In support of the implementation of the Cyber Resilience Act (Regulation EU 2024/2847), the European Commission has published draft guidelines clarifying the categorization and compliance expectations for products with digital elements (PDE
The European Union Agency for Cybersecurity (ENISA) announces the commencement of the pilot testing phase for the Single Reporting Platform (SRP). Mandated by the CRA, the SRP will serve as the centralized infrastructure for manufacturers t
Under Article 10 of the Cyber Resilience Act, the implementation of a Coordinated Vulnerability Disclosure (CVD) policy is no longer an optional best practice, but a strict legal requirement for all manufacturers of PDEs.
The European Commission, in consultation with cybersecurity authorities, has released updated clarifications regarding the regulatory treatment of free and open-source software (FOSS) under the CRA.
As part of the CRA’s incident reporting framework, manufacturers must adapt their security operations to meet strict notification timelines. Upon becoming aware of an actively exploited vulnerability or an incident with severe impact, entit
The European standardisation organisations, CEN and CENELEC, report significant progress in drafting the harmonised standards requested by the European Commission for the Cyber Resilience Act.
Effective 11 June 2026, the legal framework governing "Notified Bodies" under the CRA will officially commence. These independent, third-party conformity assessment bodies will play a vital role in auditing and certifying "important" and "c
Manufacturers are reminded that the CRA’s vulnerability reporting obligations, taking effect in September 2026, apply to all products with digital elements currently active on the Union market-not merely new products introduced after the le
In alignment with the NIS2 Directive and the Cyber Resilience Act, ENISA is currently advancing the integration of the European Vulnerability Database (EUVD) with the newly established CRA Single Reporting Platform (SRP).
A short email on the Cyber Resilience Act reporting obligations and the run-up to 11 September 2026.
We use your email only to send the briefing. Unsubscribe any time with one click.