UL Solutions flags Sept. 11 EU Cyber Resilience Act reporting deadline for connected-device makers

UL Solutions flagged a Sept. 11 start for EU Cyber Resilience Act reporting by manufacturers of connected products.

Rules require reporting actively exploited vulnerabilities or severe incidents for products already on the EU market, potentially including in-development products.

Early warning is due within 24 hours of awareness; full notification is due within 72 hours via the CRA Single Reporting Platform.

Non-compliance risk is cited at up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher.

Full CRA application is set for Dec. 11, 2027; manufacturers are urged to strengthen vulnerability management, software supply chain security and governance.