Since 11 September 2026, producers are required to report active security breaches within 24 hours. Under the CRA, ENISA and the relevant national authorities have to be made aware of any vulnerabilities. to Detailed follow-up documentation must be submitted within 72 hours. Failure to comply can result in fines of up to 15 million euros or 2.5 per cent of global annual turnover. The European Commission believes implementation costs to come in at around 29 billion euros.
In spring 2026, the German auditing firm PwC conducted a survey showing that many companies are still not prepared for the CRA: only 3 per cent of businesses believed themselves to be fully compliant. On the other hand, 27per cent had no procedures for handling product security issues in place at all.
Get your team ready, improve your processes and stay ahead of CRA compliance
Do you need help navigating the Cyber Resilience Act? trade-e-bility can guide you through the new requirements and offer practical training on CRA reporting obligations, including the relevant legal requirements, deadlines and reporting procedures for your business.
