--- title: "CRA news for machine builders | Edge SDN" description: "What changed under the Cyber Resilience Act, what it means for machine builders and what to do this month. Every item links to the official text." url: https://www.edge-sdn.com/regulations/cyber-resilience-act/news/ last_updated: 2026-10-20 --- # CRA news for machine builders What changed under the Cyber Resilience Act, what it means for the machines you build and sell, and what to do this month. We publish only when something changes what you have to do. Every item links to the official text. Edited by Edge SDN. A summary, not legal advice. Always check the official text for your case. ## [Know how a CRA report ends: ENISA adds two answers to its reporting FAQ](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-10-enisa-srp-faq-closing-reports-euvd/) 15 October 2026 · Guidance · Practical impact: Changes a reporting procedure On 15 October 2026 ENISA updated the FAQ of the CRA Single Reporting Platform with two new answers and one revised answer. Only the CSIRT designated as coordinator, the CSIRT of the Member State where the notification was submitted, can close a report. ENISA may also add a publicly known vulnerability notified under Article 14(1) to the European Vulnerability Database, in agreement with the manufacturer (Article 17(5)). ## [Germany passes its CRA law: the BSI will police the market](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-10-germany-bundestag-passes-cra-law-bsi/) 15 October 2026 · National authority · Practical impact: Adds or clarifies a duty On 15 October 2026 the German Bundestag adopted the law that implements the Cyber Resilience Act in Germany (government bill 21/6134), with one change to its entry into force. The law makes the BSI the German market surveillance authority and the notifying authority for conformity assessment bodies. It now goes to the Bundesrat and is not yet promulgated. ## [Re-read the manuals: ENISA's reporting platform is now version 1.1](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-10-srp-version-1-1-faq-update/) 12 October 2026 · Guidance · Practical impact: Changes a reporting procedure ENISA upgraded the CRA Single Reporting Platform to version 1.1 on 12 October 2026 and states that all documentation on its site reflects the changes. The FAQ was updated on 3 October 2026 and now has 33 questions, one of them marked as updated. Earlier updates in September covered the registration and notification manuals for assigned representatives, the terms and conditions dated 10 September 2026 and the page on particularly exceptional circumstances. ## [Italy names ACN as CRA market surveillance authority, decree in first reading](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-10-italy-decree-acn-market-surveillance-authority/) 2 October 2026 · National authority · Practical impact: Adds or clarifies a duty On 2 October 2026 the Italian Council of Ministers approved, in preliminary examination, the legislative decree adapting national law to the Cyber Resilience Act. The decree designates the Agenzia per la cybersicurezza nazionale (ACN) as the notifying authority for conformity assessment bodies, with assessment and monitoring entrusted to the national accreditation body. It also designates ACN as the market surveillance authority, able to call on the Guardia di Finanza. The decree still needs the opinions of Parliament before final adoption. ## [EN 40000-1-2 heads for ratification: first horizontal CRA standard](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-10-en-40000-1-2-formal-vote-closed/) 1 October 2026 · Standard · Practical impact: Standard milestone, read and align The CEN-CENELEC work programme shows EN 40000-1-2, Principles, product risk management and lifecycle activities, together with EN 40000-1-1, Vocabulary, at the approval stage with the formal vote closed on 1 October 2026 and ratification planned for 2 November 2026. EN 40000-1-2 answers line 1 of standardisation request M/606. The vulnerability handling standard prEN 40000-1-3 follows, with a shortened four-week formal vote announced by CEN-CENELEC on 2 October 2026. ## [Report exploited vulnerabilities from 11 September: ENISA's platform is live](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-09-article-14-reporting-applies-srp-live/) 11 September 2026 · Official act · Practical impact: Adds or clarifies a duty From 11 September 2026 manufacturers must notify actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements (Article 14 of the CRA, applicable under Article 71(2)). ENISA opened the Single Reporting Platform the same day. An early warning is due within 24 hours of becoming aware, a notification within 72 hours and a final report 14 days after a corrective measure is available for vulnerabilities or one month after the notification for incidents. ## [Read the 17 ETSI draft standards before the enquiry closes](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-08-etsi-17-vertical-standards-public-enquiry/) 13 August 2026 · Standard · Practical impact: Standard milestone, read and align · Deadline: 15 November 2026 On 13 August 2026 ETSI announced that 17 final draft European Standards of the EN 304 6xx series, the vertical CRA standards for product categories such as routers and switches, firewalls, VPNs, operating systems, hypervisors and network interfaces, are under public enquiry. They were submitted to 41 member organisations. The approval procedure runs until mid-September to mid-November 2026 depending on the standard. The drafts are public on the ETSI docbox. ## [Read the Commission's CRA guidance on scope, modification and support periods](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-07-commission-guidance-c-2026-5252/) 27 July 2026 · Guidance · Practical impact: Adds or clarifies a duty On 27 July 2026 the Commission published Communication C(2026) 5252 with its guidance on the application of the Cyber Resilience Act under Article 26, after a public consultation on a draft. It clarifies when products fall in scope, including remote data processing and free and open-source software, what counts as a substantial modification, how support periods should be set and the reporting obligations, with 67 practical examples, flowcharts and graphs. The Commission calls it non-binding. ## [AI in machines: the CRA assessment now counts under the AI Act](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-07-regulation-2026-1744-ai-omnibus-cra-machinery/) 24 July 2026 · Official act · Practical impact: Adds or clarifies a duty Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, amends the AI Act, Regulation (EU) 2018/1139 and the Machinery Regulation (EU) 2023/1230. A new Article 42(3) of the AI Act states that high-risk AI systems within the scope of the CRA that meet the conditions of Article 12 of the CRA are deemed to comply with the cybersecurity requirements of Article 15 of the AI Act. A recital also asks the Commission to adopt delegated acts amending Annex III of the Machinery Regulation, to apply by 2 August 2028. ## [Draft decision moves CRA standards deadlines to 30 October and 31 December 2026](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-07-draft-amendment-m606-standards-deadlines/) 7 July 2026 · Standard · Practical impact: Sets or moves a date · Deadline: 31 December 2026 On 7 July 2026 the Commission notified a draft decision amending standardisation request M/606 (C(2025) 618), with feedback open until 3 August 2026. The draft replaces Annex I: the two horizontal deliverables on the design framework (line 1) and vulnerability handling (line 15) move from 30 August to 30 October 2026, the 26 vertical standards (lines 16 to 41) move from 30 October to 31 December 2026 and the product-property standards (lines 2 to 14) stay at 30 October 2027. As of 16 October 2026 the decision is not adopted. ## [Chapter IV applies: notified bodies can now be designated](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-06-chapter-iv-notified-bodies-applies/) 11 June 2026 · Official act · Practical impact: Sets or moves a date · Deadline: 11 December 2026 Articles 35 to 51 of the Cyber Resilience Act, on notifying authorities and conformity assessment bodies, apply from 11 June 2026 under Article 71(2). Member States must have designated their notifying authorities by that date and, under Article 35(2), should strive to have a sufficient number of notified bodies by 11 December 2026. On 31 July 2026 the Commission wrote that NANDO will list CRA notified bodies "once available". ## [Know who sees your report: CSIRT dissemination rules are in force](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-04-delegated-regulation-2026-881-csirt-delay-dissemination/) 20 April 2026 · Official act · Practical impact: Changes a reporting procedure Commission Delegated Regulation (EU) 2026/881, adopted on 11 December 2025 and published in the Official Journal on 20 April 2026, specifies the terms and conditions under which the CSIRT that receives a manufacturer's notification may delay passing it on to the other CSIRTs, on cybersecurity-related grounds (Article 16(2) of the CRA). ## [Radio equipment in machines moves from RED to CRA on 11 December 2027](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-02-delegated-regulation-2026-339-repeals-red-cybersecurity-act/) 16 February 2026 · Official act · Practical impact: Sets or moves a date · Deadline: 11 December 2027 Commission Delegated Regulation (EU) 2026/339 of 16 February 2026 repeals Delegated Regulation (EU) 2022/30, the act that activated the cybersecurity requirements of the Radio Equipment Directive. The repeal takes effect from 11 December 2027, the day the CRA applies in full, so that the two sets of requirements do not overlap. ## [Check your product class against the new legal descriptions](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2025-12-implementing-regulation-2025-2392-important-critical-products/) 1 December 2025 · Official act · Practical impact: Adds or clarifies a duty Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 was published in the Official Journal on 1 December 2025. It gives the technical description of the product categories listed in Annex III (important products) and Annex IV (critical products) of the Cyber Resilience Act, as Articles 7(4) and 8 of the CRA require. Standards tracker: https://www.edge-sdn.com/regulations/cyber-resilience-act/standards/ RSS feed: https://www.edge-sdn.com/regulations/cyber-resilience-act/news/feed.xml