Cyber Resilience Act: reporting duties start this September

The European Commission’s implementation timetable sets 11 September 2026 as the start of reporting obligations under the Cyber Resilience Act. Full application follows on 11 December 2027. These are different milestones for manufacturers of products with digital elements.

Guidance published in July addresses scope, support periods, substantial modifications and reporting. The Commission describes it as non-binding. A company must still establish whether its particular product falls within the regulation.

For dual-use software and connected-device suppliers, our practical priority is ownership: who receives a security report, decides what it means and coordinates the response? Leaving that responsibility undefined creates avoidable delays. The timetable alone does not answer product-specific legal questions.