Blog
What the Cyber Resilience Act requires, article by article, and by when. Every claim links to its source; what is not binding is flagged as such.
Does the CRA apply to your product? Three questions to place it
The Cyber Resilience Act is the EU regulation that imposes cybersecurity obligations on digital products made available on the Union market. It does not cover everyone, and the dividing line is not the one most people expect: it depends neither on your sector nor on your technology.
The 26 fields of the ENISA notification: what to prepare before 11 September 2026
The reporting form for an actively exploited vulnerability has 26 fields. The Regulation itself names almost none of them. Five carry information you already hold today; seven will have to be written during the incident.
Article 14: five mandatory fields at 24 hours
The Article 14 reporting obligation applies from 11 September 2026. The first stage asks for five fields, with no CVE identifier and no CVSS score. The real load lands at 72 hours, and it calls for judgement rather than data.