11 September 2026

Manufacturers must report actively exploited vulnerabilities and severe incidents in products with digital elements (Article 14).

This date already applies.

Every date it has had

1. 11 September 2026 (in force): Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 71(2).
   “Article 14 shall apply from 11 September 2026”
   Official text · SHA-256 fe0cca4a0caec50e…

All EU deadlines · JSON: /v1/eu/deadlines/cra-reporting-obligations

Last checked 20 October 2026. This is information, not legal advice.