The European Commission confirms that Cyber Resilience Act reporting obligations for manufacturers have applied since 11 September 2026. They cover actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. This is a September implementation update, not a claim that the entire regulation took effect today.

The Commission describes an early warning within 24 hours of awareness and a full notification within 72 hours. Manufacturers report through the CRA Single Reporting Platform. These are regulatory reporting deadlines, not promises that a consumer will receive a patch within the same period.

The main CRA obligations apply from 11 December 2027. The Commission separately places the reporting obligations for open-source software stewards at that later date. A blanket statement that every software project must already follow the manufacturer timetable would therefore mislead readers.

For a router, camera or software purchase, ask the seller for the stated security-support period, update instructions and vulnerability contact. Do not treat the September milestone as proof that a particular model has passed a security assessment. This buyer briefing summarizes official guidance; it does not determine any company’s legal obligations.