--- title: What the EU CRA actually asks of your engineering team description: The EU Cyber Resilience Act creates concrete engineering obligations, not just legal ones. From 11 September 2026, teams must report actively exploited... canonical: https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What the EU CRA actually asks of your engineering team | daily.dev og:description: The EU Cyber Resilience Act creates concrete engineering obligations, not just legal ones. From 11 September 2026, teams must report actively exploited... og:url: https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88 og:image: https://api.daily.dev/og/posts/SYiMWSX88.png og:image:alt: What the EU CRA actually asks of your engineering team og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What the EU CRA actually asks of your engineering team **[Kilo Blog](https://daily.dev/sources/kilo-ai-blog)** · 15 min read · 0 upvotes · 0 comments ## Summary The EU Cyber Resilience Act creates concrete engineering obligations, not just legal ones. From 11 September 2026, teams must report actively exploited vulnerabilities and severe incidents (like a compromised build pipeline) within 24 hours of awareness, with fuller reports at 72 hours and a final report within 14 days of a fix. From 11 December 2027, the full regulation applies including vulnerability handling, conformity assessment, and CE marking. Products that run on a user's device (installers, CLIs, agents, mobile apps) are in scope; pure SaaS generally isn't. Manufacturers are accountable for vulnerabilities in every integrated component, even open-source ones they didn't write, and are expected to push fixes upstream. Security patches generally don't trigger a new conformity assessment as long as they don't change the product's cybersecurity risk profile or intended purpose, but bundling feature changes with patches removes that protection. Support periods default to a five-year floor, and documentation and security updates must remain available for at least 10 years. Practical prep before the September deadline: register for an EU Login account, identify your designated CSIRT, assign someone authority to file, write severity-based remediation deadlines, and start recording triage decisions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When does the EU Cyber Resilience Act reporting obligation start and what has to be reported first? Reporting obligations under Article 14 of the EU Cyber Resilience Act begin on 11 September 2026, requiring manufacturers to report actively exploited vulnerabilities and severe incidents affecting product security. The full regulation, including essential requirements, vulnerability handling, and conformity assessment, applies later, from 11 December 2027. Reports go through ENISA's Single Reporting Platform on a 24-hour, 72-hour, and 14-day rhythm. _Teams tracking regulatory deadlines that affect their release process can follow CRA developments on daily.dev._ ### Does shipping a security patch trigger a new conformity assessment under the EU Cyber Resilience Act? Generally no. Recital 39 of the Cyber Resilience Act states that a security update which doesn't change a product's intended purpose isn't a substantial modification, even if it introduces significant technical changes, as long as it addresses a known vulnerability without altering the cybersecurity risk profile. Bundling a feature change with the patch, however, can still make the feature change count as a substantial modification. _Developers deciding how to structure release pipelines under new compliance rules can track CRA guidance on daily.dev._ ### Are companies responsible for vulnerabilities in open-source dependencies they didn't write under the CRA? Yes. Vulnerability-handling obligations under the Cyber Resilience Act apply to a product in its entirety, including every integrated component, even ones the manufacturer didn't build and whose original developer isn't itself subject to CRA obligations. Manufacturers are expected to notify upstream maintainers of vulnerabilities they find, remediate them in their own product, and share fixes, though July 2026 guidance narrows the upstream notification duty when the maintainer already knows or no maintainer remains. _Teams managing third-party dependency risk can keep up with compliance obligations like these via daily.dev._ ## Similar posts on daily.dev - [EU’s Cyber Resiliency Act will put IT leaders to the test](https://daily.dev/posts/eu-s-cyber-resiliency-act-will-put-it-leaders-to-the-test-ufqkjfyfz) · CSO Online · 0 upvotes · 0 comments - [CRA’s First Connected-Products Deadline Is in Less Than 100 Days](https://daily.dev/posts/cra-s-first-connected-products-deadline-is-in-less-than-100-days-7zrubiyyy) · Embedded.com · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What the EU CRA actually asks of your engineering team","url":"https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88"},"datePublished":"2026-08-19T13:03:30.249Z","dateModified":"2026-09-13T19:20:21.822Z","description":"The EU Cyber Resilience Act creates concrete engineering obligations, not just legal ones. From 11 September 2026, teams must report actively exploited...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4009a7a2658f80cf7e736848f85084a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4009a7a2658f80cf7e736848f85084a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Kilo Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Kilo Blog","logo":"https://media.daily.dev/image/upload/s--x3pmrf8D--/f_auto,q_auto/v1774964071/logos/kilo-ai-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/kilo-ai-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,compliance","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Kilo Blog","item":"https://daily.dev/sources/kilo-ai-blog"},{"@type":"ListItem","position":3,"name":"What the EU CRA actually asks of your engineering team"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88#faq","mainEntity":[{"@type":"Question","name":"When does the EU Cyber Resilience Act reporting obligation start and what has to be reported first?","acceptedAnswer":{"@type":"Answer","text":"Reporting obligations under Article 14 of the EU Cyber Resilience Act begin on 11 September 2026, requiring manufacturers to report actively exploited vulnerabilities and severe incidents affecting product security. The full regulation, including essential requirements, vulnerability handling, and conformity assessment, applies later, from 11 December 2027. Reports go through ENISA's Single Reporting Platform on a 24-hour, 72-hour, and 14-day rhythm. Teams tracking regulatory deadlines that affect their release process can follow CRA developments on daily.dev."}},{"@type":"Question","name":"Does shipping a security patch trigger a new conformity assessment under the EU Cyber Resilience Act?","acceptedAnswer":{"@type":"Answer","text":"Generally no. Recital 39 of the Cyber Resilience Act states that a security update which doesn't change a product's intended purpose isn't a substantial modification, even if it introduces significant technical changes, as long as it addresses a known vulnerability without altering the cybersecurity risk profile. Bundling a feature change with the patch, however, can still make the feature change count as a substantial modification. Developers deciding how to structure release pipelines under new compliance rules can track CRA guidance on daily.dev."}},{"@type":"Question","name":"Are companies responsible for vulnerabilities in open-source dependencies they didn't write under the CRA?","acceptedAnswer":{"@type":"Answer","text":"Yes. Vulnerability-handling obligations under the Cyber Resilience Act apply to a product in its entirety, including every integrated component, even ones the manufacturer didn't build and whose original developer isn't itself subject to CRA obligations. Manufacturers are expected to notify upstream maintainers of vulnerabilities they find, remediate them in their own product, and share fixes, though July 2026 guidance narrows the upstream notification duty when the maintainer already knows or no maintainer remains. Teams managing third-party dependency risk can keep up with compliance obligations like these via daily.dev."}}]} ```