EU Sets New Cybersecurity Rules

The EU's Cyber Resilience Act introduces new cybersecurity rules for all software and hardware, with compliance deadlines approaching in 2026 and 2027.

The European Union is preparing to implement its Cyber Resilience Act (CRA), a significant regulation aimed at improving cybersecurity for consumers. This new law will establish a wide range of accountability standards for companies that sell software and hardware products within the EU. The goal is to protect users from growing cyber risks by making manufacturers responsible for the security of their products. The regulation sets two critical deadlines for compliance. The first, on September 11, 2026, mandates new reporting obligations for vulnerabilities that are being actively exploited. The second, on December 11, 2027, will bring all other major requirements of the act into full effect.

The CRA represents a major shift in responsibility, placing the burden of security squarely on the shoulders of product creators. This impacts a broad range of roles, from developers and security teams to CTOs and company founders. Businesses operating in the EU market must now proactively integrate security into their development processes and prepare for rigorous reporting requirements. The long-term nature of these changes means that strategic planning cannot be delayed. Companies need to begin assessing their products and internal processes now to ensure they can meet the 2026 and 2027 deadlines and avoid potential penalties.