Cyber Resilience Act Compliance: 24-Hour Clock

The vulnerability report lands on a Friday afternoon. Someone on a security mailing list has proof that a bug in your firmware is being exploited in the wild, on customer devices, right now. Before 11 September 2026 that started a conversation with engineering. After it, it starts a stopwatch. Cyber Resilience Act compliance turns that moment into a filing deadline measured in hours, and the clock does not care that your incident lead is on a plane.

Why Does The 11 September Deadline Matter?

The 11 September 2026 date matters because it is the first Cyber Resilience Act obligation with real enforcement behind it, arriving well ahead of the full application of the Act at the end of 2027.

The mechanism is narrower than the headlines suggest. You file once, through the CRA Single Reporting Platform, to the computer security incident response team in the country where your main establishment sits, and that team passes it on to every other CSIRT where the product is sold. ENISA sees it at the same time. One filing, one platform, twenty-seven markets covered. Set against the patchwork most manufacturers already handle under other EU rules, including the transparency duties that came into force under the EU AI Act in August, this part is a real simplification.

The common advice right now is to wait for the harmonised standards before doing anything. That advice is wrong for reporting. Wrong for most of the Act, actually, but reporting is where it costs you soonest. Standards govern how you demonstrate that a product meets the essential requirements, and those obligations arrive more than a year later. Article 14 reporting does not wait for a standard. It needs a named person, a monitored inbox and a decision rule about what counts as evidence of exploitation, all of which you can build this month.

Cost is where this stops being an engineering conversation. The European Commission's 2022 impact assessment, the document that underpins the Act, priced compliance at roughly 2% of the €1.485 trillion of EU turnover the rules touch. That is the same order of magnitude producers found when packaging EPR reporting landed across seven US states this year, and the pattern rhymes. A rule written for accountability produces, first, a data collection problem.

Look at the development uplift on its own. It is not a fee you pay at the end, and it is not something a certification body sells you. It is threat modelling, dependency hygiene, a signed update channel and someone whose job is to say no to a shipping date. Firms already doing that will barely feel the Act. Firms treating security as a pre-launch audit will find that the money was never the hard part.

What Cyber Resilience Act Compliance Costs

The Act charges a manufacturer twice, once to prove a product is secure before it ships and then continuously for its whole supported life, which is why the assessment fee everyone quotes understates the bill.

The numbers below are the ones a finance lead asks for first. Two of them are choices rather than fixed costs, namely the assessment route you take and how long you commit to supporting the product.

Read the fines rows twice. Each tier is an amount or a percentage of worldwide turnover, whichever is higher, so the ceiling scales with the company rather than with the product. A small firm's exposure sits near the cash figure. A large one's does not, and that asymmetry is deliberate.

How Do Manufacturers Comply Without Tripping Up?

Manufacturers comply by deciding now who files, from which legal entity, and on what evidence, because most first-year failures will be procedural rather than technical: the right facts, reported by the wrong entity, after the window closed.

Start with the definition, because it is doing more work than people expect. A vulnerability counts as actively exploited when there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. Reliable evidence, not a proof of concept, and not a scanner finding. A severe incident is one affecting the product's ability to protect sensitive data or functions, or one that has led to malicious code being introduced or executed. Both definitions are broad enough that your triage rule matters more than your detection tooling.

Small manufacturers feel this hardest, for the same reason they felt AI adoption hardest: the fixed cost of doing something properly does not shrink with headcount. The arithmetic in the real costs and honest ROI of AI agents for small business has the same shape here. What nobody can tell you yet is how proportionately enforcement will land on a small firm whose exposure arrived through an unmaintained dependency it did not write. The Act has language for open source stewards. Whether a market surveillance authority reads that language generously in year one is a guess, and the likelier outcome is that early enforcement targets firms that ignored a report rather than firms that filed a clumsy one.

• End-of-life components. If a dependency stopped receiving fixes, you inherit the reporting duty for whatever it does next.
• Entity confusion. The filing comes from the manufacturer, which in a group structure is often not the company whose name sits on the support portal.
• Clock start. The window opens when you become aware, not when you finish investigating.
• Contract gaps. Suppliers who owe you nothing on disclosure timing will quietly consume a window you cannot extend.

If you make anything with software in it and sell it in Europe, the useful step this week is small. Find out which legal entity is the manufacturer, and give that entity a monitored address a CSIRT filing can come from. Most of the rest can wait a month. That cannot.