Full Report
The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws. ActiveState explains why knowing exactly what shipped and when vulnerabilities were discovered will be critical to meeting the new requirements. [...]
Analysis Summary
# Regulation/Compliance: EU Cyber Resilience Act (CRA)
## Overview
The EU Cyber Resilience Act (CRA) establishes a mandatory framework for the security of "products with digital elements" (PDEs). It aims to ensure that hardware and software products are placed on the market with fewer vulnerabilities and that manufacturers remain responsible for security throughout a product's life cycle. A critical near-term focus of the act is the mandatory reporting of actively exploited vulnerabilities to EU authorities.
## Key Details
- **Issuing Authority:** European Commission / ENISA (European Union Agency for Cybersecurity)
- **Effective Date:** September 11, 2026 (Reporting obligations); December 11, 2027 (Engineering/Product requirements)
- **Jurisdiction:** European Union (Applies to any product sold within the EU market)
- **Status:** Final / Legally Adopted
## Requirements
### Mandatory Requirements
1. **Early Warning (24 Hours):** Manufacturers must notify ENISA within 24 hours of becoming aware of any actively exploited vulnerability in their product.
2. **Incident Notification (72 Hours):** A detailed follow-up report must be submitted within 72 hours of discovery.
3. **Software Bill of Materials (SBOM):** Per Article 13, manufacturers must maintain an accurate, up-to-date SBOM for their products.
4. **Security Support:** Products must be designed, developed, and produced in a way that ensures an appropriate level of cybersecurity.
5. **Vulnerability Handling:** Documented processes for receiving, investigating, and remediating vulnerability reports.
### Recommended Practices
1. **Automated SBOM Regeneration:** Instrumenting CI/CD pipelines to update SBOMs automatically upon every build rather than static annual reporting.
2. **Provenance Tracking:** Treating software provenance as a continuous property of the supply chain.
3. **Curation:** Using curated catalogs for open-source components to mitigate supply chain risks.
## Affected Organizations
- **Industries:** Software developers, hardware manufacturers, and any entity placing digital products on the EU market.
- **Organization Size:** All sizes (including open-source projects that are considered "commercial activities").
- **Geographic Scope:** Global companies; any organization outside the EU that sells digital products to customers located within the EU.
## Compliance Timeline
- **September 11, 2026:** Mandatory reporting of exploited vulnerabilities and incidents begins.
- **December 11, 2027:** Full compliance required, including engineering requirements and product security mandates.
## Implementation Guidance
### Assessment Phase
- **Inventory Products:** Identify all products with digital elements sold in the EU.
- **Supply Chain Audit:** Determine the percentage of open-source components (industry average is ~98%) and current SBOM accuracy.
- **Gap Analysis:** Compare current remediation times (average is 55 days) against the required 24/72-hour reporting windows.
### Implementation Phase
- **Establish Reporting Channels:** Designate a "named owner" for vulnerability handling and reporting to ENISA.
- **Automate Visibility:** Implement tooling to provide real-time visibility into "what shipped and when."
- **Standardize Disclosures:** Create a formal vulnerability disclosure program (VDP).
### Validation Phase
- **Reporting Drills:** Test the ability to identify an exploit and notify authorities within the 24-hour window.
- **SBOM Verification:** Audit SBOMs to ensure they reflect the current "running" version of software, not a stale version.
## Technical Requirements
- **SBOM Article 13 Compliance:** Must provide a machine-readable inventory of software components.
- **Exploit Monitoring:** Technical controls to detect active exploitation of vulnerabilities in the field.
- **Security Updates:** Capability to deliver secure, authenticated updates to remediate flaws.
## Penalties & Enforcement
- **Fines:** Non-compliance can result in administrative fines of up to €15 million or 2.5% of the total worldwide annual turnover, whichever is higher.
- **Other Consequences:** Market withdrawal or recall of non-compliant products; prohibition of products being made available on the EU market.
- **Enforcement:** Conducted by national market surveillance authorities of EU Member States.
## Related Standards
- **NIST SSDF:** Aligns with secure software development framework principles.
- **ISO/IEC 29147 & 30111:** International standards for vulnerability disclosure and handling.
- **Executive Order 14028 (US):** Similar SBOM requirements, though the CRA is more explicit regarding "current" vs. "stale" data.
## Resources
- **Official Documentation:** [European Commission - Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)
- **Guidance Documents:** [ENISA Vulnerability Disclosure Guidelines](https://www.enisa.europa.eu/)
- **Tools:** ActiveState (for SBOM and supply chain provenance).
## Practical Recommendations
- **Bridge the Gap:** Recognize that from 2026 to 2027, the CRA is primarily a **visibility** requirement. Focus immediately on the "what shipped and when" question.
- **Prioritize Remediation:** Since remediation takes 55 days on average, but reporting is required in 24 hours, organizations must improve their patching velocity to avoid prolonged legal exposure.
- **Move Beyond Static SBOMs:** Stop treating SBOMs as static documents for auditors; treat them as dynamic operational data.