What changed under the Cyber Resilience Act, what it means for the machines you build and sell, and what to do this month. We publish only when something changes what you have to do. Every item links to the official text.
Edited by Edge SDN. A summary, not legal advice. Always check the official text for your case.
By month October 2026 · September 2026 · August 2026 · July 2026 · June 2026 · April 2026 · February 2026 · December 2025
Practical impact Changes a reporting procedure
On 15 October 2026 ENISA updated the FAQ of the CRA Single Reporting Platform with two new answers and one revised answer.
Reporting duty (Art. 14) Installed base
Practical impact Changes a reporting procedure
1 on 12 October 2026 and states that all documentation on its site reflects the changes. The FAQ was updated on 3 October 2026 and now has 33 questions, one of them marked as updated.
Reporting duty (Art. 14)
Practical impact Adds or clarifies a duty
On 2 October 2026 the Italian Council of Ministers approved, in preliminary examination, the legislative decree adapting national law to the Cyber Resilience Act.
New machines from 11 Dec 2027 Reporting duty (Art. 14) Importers and distributors
Practical impact Adds or clarifies a duty
From 11 September 2026 manufacturers must notify actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements (Article 14 of the CRA, applicable under Article 71(2)).
Reporting duty (Art. 14) Installed base
Practical impact Changes a reporting procedure
Commission Delegated Regulation (EU) 2026/881, adopted on 11 December 2025 and published in the Official Journal on 20 April 2026, specifies the terms and conditions under which the CSIRT that receives a manufacturer's notification may…
Reporting duty (Art. 14)