Organizations that do business in the European Union (EU) will now have to report product security issues quickly and diligently or face steep penalties.
The EU's Cyber Resilience Act (CRA) possesses a variety of regulations that won't be strictly enforced until December 2027. Organizations have plenty of time to make sure they meet the EU's requirements around, for example, software bills of material (SBOMs), vulnerability handling processes, risk assessments, and other aspects. However, as if to highlight its singular significance, the EU has fast-tracked a particular chunk of the CRA, so that it will come into effect more than a year before everything else.
Beginning Sept. 11, all organizations that sell products in member countries will now be subject to strict reporting obligations. Namely, when they discover actively exploited vulnerabilities or severe security incidents affecting their products, they will have to report these issues to the European Union Agency for Cybersecurity (ENISA) within 24 hours. If they don't, they could face fines of up to 15 million euros.