Cyber Resilience Act news
The CRA is in force, but much is still in motion: the German implementation act, harmonised standards, notified bodies and the ENISA platform. This is where we track what is changing and what it means for manufacturers.
Legal status as of 8 October 2026. Not legal advice.
- EN 40000-1-1 and EN 40000-1-2 have passed the formal vote, but no standard is in the Official Journal yetAccording to secondary sources, the first two CRA standards have been approved. There is still no presumption of conformity.
- Germany's CRA implementation act is stuck in the Committee on Internal AffairsNo objections from the Bundesrat, with the Committee on Internal Affairs since June, not on the October agenda. What is still missing.
- ENISA FAQ of 3 October 2026: the 72-hour counter on the platform shows 48 hoursThe platform counts the 72-hour deadline from the early warning. A field for the time of awareness is still missing for vulnerabilities.
- Swiss Federal Council commissions a cybersecurity act modelled on the CRAConsultation draft due by June 2027. For Swiss manufacturers supplying the EU, the CRA already applies.
- Fines under the CRA only apply from 11 December 2027Reporting obligation since September 2026, fines regime only from December 2027. The deadlines apply regardless.
- ENISA publishes the list of coordinating CSIRTs: CERT-Bund for Germany, CERT.at for AustriaThe list for all 27 Member States is out. What to select when registering on the reporting platform.
The reporting obligation already applies. Who answers at night at your company?
CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.