Platform & Regulatory Announcements
Stay informed on Cyber Resilience Act milestones, regulatory guidelines, and platform updates.
Looking for press coverage from around the web? CRA News →
ENISA published its 5-year cybersecurity assessment report (2021-2025). The data confirms SOG-IS certificate issuance ended in February 2026, EUCC launched with 24 accredited laboratories, and CEN/CENELEC EN 17640 (FiTCEM) established fixed-time SME testing across the EU.
Filing an Article 14 notification requires an EU Login account, your coordinating CSIRT has to validate your reporters after you first sign in, and ENISA has confirmed there will be no submission API. All three have lead times, and the platform opens on the same day the 24-hour clock starts.
Twenty-two playbooks covering secure by design and secure by default across a product life cycle, aimed at SMEs and published on GitHub under CC BY 4.0. It is ENISA guidance rather than a harmonised standard, so applying it confers no presumption of conformity.
Version 2.1 replaces the 2021 NTIA baseline and takes the field count from seven to seventeen. It is not Union law. Seven EU national cybersecurity agencies co-authored it anyway, so expect procurement to follow it, and an SBOM built to the CRA floor fails it by construction.
ETSI TC CYBER has published draft Cyber Resilience Act standards for anti-malware software, firewalls, routers, hypervisors and other Annex III product categories, the first of 18 product-specific deliverables under standardisation request M/606.
C(2026) 5252 sets out the Commission's own reading of the CRA across 84 pages and 67 worked examples. It defines when the Article 14 reporting clock starts, gives a four-factor test for substantial modification, and confirms that five years of support is a floor rather than a default.
Article 31(2) requires the technical file to be continuously updated during the support period, Article 13(3) puts the same clock on the risk assessment, and Article 28 keeps the Declaration of Conformity current. A new walkthrough covers the update duties, the trigger events and a review cadence that holds up.
CISA, NSA, JPCERT/CC, NCSC-NL, and NCSC-UK published a joint guide on establishing a coordinated vulnerability disclosure programme. It names the EU Cyber Resilience Act directly.
CISA, NSA, JPCERT/CC, NCSC-NL and NCSC-UK released joint guidance on building a coordinated vulnerability disclosure program. We mapped every recommendation against CVD Portal.
The CRA requires a coordinated vulnerability disclosure policy, a bug bounty is optional. Our new guide explains how the two approaches relate and how AI triage keeps up when report volume grows.
CVD Portal will be at GITEX AI Europe in Berlin on 30 June and 1 July 2026, stand H2.2-B90 at Messe Berlin. Come see how manufacturers run Coordinated Vulnerability Disclosure and meet the EU Cyber Resilience Act reporting obligations that start applying on 11 September 2026.
A European Commission Delegated Regulation published in December 2025 specifies when a coordinating CSIRT may delay onward distribution of a manufacturer's CRA notification on security grounds. The mechanism shapes how sensitive reports move through ENISA's Single Reporting Platform.
The Netherlands missed the NIS2 transposition deadline by nearly two years. The Cyberbeveiligingswet has now cleared the House of Representatives and the government is targeting entry into force on 1 July 2026, with no grace period and personal liability for directors. Our latest piece walks Dutch executives through the four obligations that change how boards operate.
A single exploited flaw can start a CRA early warning, a NIS2 significant-incident notification and a GDPR breach report at once, each on its own deadline and to its own authority. Our latest piece maps where the obligations overlap and where they diverge.
The CRA's reporting obligations do not switch on with the rest of the regulation. Article 14 applies from 11 September 2026, ahead of full conformity in December 2027, and binds manufacturers the moment a product becomes actively exploited.
Most vulnerabilities a manufacturer handles never trigger a report to authorities. The CRA's Article 14 duty is narrow: actively exploited vulnerabilities and severe incidents affecting product security. Here is how to tell what is in scope.
Article 14 is a three-stage cascade: a 24-hour early warning, a 72-hour detailed notification, and a final report within 14 days or one month. Here is what each stage contains, when the clock starts, and the follow-up duties that continue afterward.
When an Article 14 event occurs, a manufacturer does not file with a single regulator. The CRA routes reports through one ENISA-operated platform to ENISA and the relevant national CSIRT at once, with onward distribution where needed.
Open Bug Bounty and CVD Portal both deal with vulnerability disclosure, but they serve entirely different purposes. One is a community-driven reporting network, the other is a regulatory compliance tool built for the European market.
The CRA's 24-hour clock is won or lost inside your own organisation, long before a report reaches ENISA. A practical guide to the detection sources, escalation paths, and decision authority that turn a vague late-night signal into a filed early warning.
Article 14 reporting should be the visible output of a healthy product security programme. This closing article shows how reporting connects to vulnerability handling, SBOM, secure development, and post-market surveillance.
We didn't set out to build a SaaS product. We set out to answer a question that kept coming up in our conversations with EU manufacturers: where do we actually start?
For a typical EU SME manufacturer (20-50 FTE, one product line, no existing CVD programme), the expected cost of meeting the CRA Article 14 reporting deadline on 11 September 2026 is approximately €39,700, with a 90% confidence interval of
For over a decade, Coordinated Vulnerability Disclosure (CVD) has relied on the 90-day disclosure window. Security researcher Himanshu Anand argues that LLMs have rendered this framework obsolete by compressing both vulnerability discovery
In a Help Net Security interview, Nuno Rodrigues Carvalho, Head of Sector for Incident and Vulnerability Services at ENISA, addressed the recent CVE funding scare, EU regulatory enforcement, and why vulnerability disclosure is becoming a co
11 September 2026 is when Article 14 reporting obligations become enforceable - for products already on the market. Full CRA conformity isn't until December 2027. The September deadline is the operational one.
Two terms. One letter of difference. Entirely different legal consequences under the Cyber Resilience Act.
The EU Cyber Resilience Act is becoming a primary driver of security investment decisions across Europe.
As the European Union continues to strengthen its digital market, stakeholders are reminded that the first critical compliance milestone of the Cyber Resilience Act (CRA) is approaching. Effective 11 September 2026, manufacturers of product
In support of the implementation of the Cyber Resilience Act (Regulation EU 2024/2847), the European Commission has published draft guidelines clarifying the categorization and compliance expectations for products with digital elements (PDE
The European Union Agency for Cybersecurity (ENISA) announces the commencement of the pilot testing phase for the Single Reporting Platform (SRP). Mandated by the CRA, the SRP will serve as the centralized infrastructure for manufacturers t
Under Article 10 of the Cyber Resilience Act, the implementation of a Coordinated Vulnerability Disclosure (CVD) policy is no longer an optional best practice, but a strict legal requirement for all manufacturers of PDEs.
The European Commission, in consultation with cybersecurity authorities, has released updated clarifications regarding the regulatory treatment of free and open-source software (FOSS) under the CRA.
As part of the CRA’s incident reporting framework, manufacturers must adapt their security operations to meet strict notification timelines. Upon becoming aware of an actively exploited vulnerability or an incident with severe impact, entit
The European standardisation organisations, CEN and CENELEC, report significant progress in drafting the harmonised standards requested by the European Commission for the Cyber Resilience Act.
Effective 11 June 2026, the legal framework governing "Notified Bodies" under the CRA will officially commence. These independent, third-party conformity assessment bodies will play a vital role in auditing and certifying "important" and "c
Manufacturers are reminded that the CRA’s vulnerability reporting obligations, taking effect in September 2026, apply to all products with digital elements currently active on the Union market-not merely new products introduced after the le
In alignment with the NIS2 Directive and the Cyber Resilience Act, ENISA is currently advancing the integration of the European Vulnerability Database (EUVD) with the newly established CRA Single Reporting Platform (SRP).
A short email on the Cyber Resilience Act reporting obligations and the run-up to 11 September 2026.
We use your email only to send the briefing. Unsubscribe any time with one click.