EU Cyber Resilience Act

Reporting obligations under the EU Cyber Resilience Act take effect in September 2026, requiring companies that sell connected products in the EU to notify authorities of actively exploited vulnerabilities and security incidents. Legal commentators are flagging the compliance work manufacturers must complete before the deadline. Businesses are advised to review their product security and incident-reporting processes now.