CRA vulnerability reporting has applied since September 11, 2026; its main obligations apply on December 11, 2027. AI Act high-risk obligations moved to December 2, 2027. A practical, engineering-side reading of what each means for software products and connected devices sold in the EU, and what to have in place a year early.
The CRA covers "products with digital elements" placed on the EU market: software and hardware with software in it, including connected devices. Its reporting obligations have applied since September 11, 2026: manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, with an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days of a fix being available for exploited vulnerabilities. The main obligations (designing, updating and maintaining products to protect users) apply from December 11, 2027.
A software bill of materials for each product version, and a process for tracking vulnerabilities in it.
Security updates delivered for the product's support period, separately from feature updates where possible — for devices, a working over-the-air update mechanism from the first shipped unit.
Secure defaults: no shared default passwords, minimal exposed services, data protected in transit and at rest.
A vulnerability disclosure policy and a way for researchers to reach you.
An incident process fast enough to meet the 24-hour early-warning window — which means someone is on call for it.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
The Digital Omnibus on AI, in force since July 27, 2026, moved the obligations for high-risk AI systems listed in Annex III — biometrics, employment, credit scoring, education, critical infrastructure and similar uses — to December 2, 2027, and those in Annex I to August 2, 2028. Transparency obligations, such as telling people they are talking to a chatbot and labelling synthetic media, and the rules for general-purpose AI models were not delayed.
Risk management and testing across the system's life — evaluation sets and their results, kept.
Data governance for training and evaluation data.
Logging that lets decisions be traced afterwards.
Human oversight designed in, not bolted on.
Technical documentation that matches what is actually deployed.
A connected device sold in the EU after December 11, 2027 needs the CRA work done before it ships, alongside the radio and EMC requirements it already had. The practical consequences for small hardware teams: choose a platform with secure boot and signed over-the-air updates, generate an SBOM from the firmware build, never ship a shared default credential, and plan the support period — and the cloud backend that delivers updates — as part of the product, not an afterthought.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
SOC 2 on AWS: What You Actually Need to Pass the Audit
The AWS controls that actually matter for SOC 2 Type II, and the ones that are pure checkbox theater. Based on real audit experience.
Read
Certifying an ESP32 Product in 2026: FCC, CE, RED Cybersecurity and the CRA, for Small Teams
A pre-certified ESP32 module makes certifying your product much easier, though it doesn't do it for you. What the FCC's modular approval actually covers, what the EU's RED cybersecurity rules have required since August 2025, how the Cyber Resilience Act takes over in December 2027, and a realistic path for a small hardware team.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.