Welcome back to Kokobo’s tech breakdown. If you manufacture, distribute, or sell connected devices in the European Union, January 2026 marks the beginning of a massive regulatory shift. The EU Cyber Resilience Act (CRA) officially entered into force in December 2024, but 2026 is the year the grace period ends and the real operational infrastructure takes over.
While full product compliance requirements (like mandatory CE marking for cybersecurity) do not hit until December 11, 2027, the initial shockwave arrives much sooner. If you are waiting until 2027 to overhaul your security operations, you are already behind schedule.
The September 11 “Legacy Trap” Deadline
Starting September 11, 2026, manufacturers must comply with aggressive new incident reporting obligations. Crucially, these reporting rules apply to all products in the scope of the CRA that are already placed on the EU market. It does not matter if your product shipped in 2019; if it is still actively used and contains an actively exploited vulnerability, you must detect it and report it.
The CRA mandates a strict, non-negotiable multi-tiered reporting process via the EU Agency for Cybersecurity (ENISA) Single Reporting Platform:
| Reporting Window | Reporting Requirement | Recipient Authorities |
| Within 24 Hours | The Early Warning Notification: An alert of an actively exploited vulnerability or severe incident. This requires a highly tuned internal triage process. | National CSIRT and ENISA |
| Within 72 Hours | The Vulnerability Notification: A detailed report outlining the general nature of the exploit, initial mitigating measures taken, actionable steps users can take, and an assessment of vulnerability sensitivity. | National CSIRT and ENISA |
| Within 14 Days | The Final Report: Submitted no later than 14 days after a corrective measure (like a firmware patch) is available. Detailed post-mortem covering root cause, severity, impact, and threat actor data. | National CSIRT and ENISA |
Conformity Assessments Go Live in June
To prepare the market for the massive 2027 rollout, the legal framework for Conformity Assessment Bodies (CABs) becomes operational on June 11, 2026. These independent, state-notified laboratories will begin testing and certifying products to ensure they meet CRA standards.
While roughly 90% of standard connected products will only require a manufacturer’s self-declaration of conformity, products categorized as “important” or “critical” will face rigorous third-party auditing. This includes password managers, smart meter gateways, firewalls, and operating systems. Once a CAB is successfully notified, it will be added to the EU’s “NANDO” list, kicking off a mad dash for manufacturers trying to secure auditing slots before the 2027 backlog begins.
The Financial and Operational Stakes
The financial penalties for failing to meet these new standards are unprecedented in the hardware and software space. Fines for serious violations can reach up to €15 million or 2.5% of a company’s global annual turnover, whichever is higher.
For most companies, the primary objective for the first half of 2026 must be building the minimum operational capability to comply with the September reporting obligations. This means establishing a Coordinated Vulnerability Disclosure (CVD) policy, mapping out your CRA exposure across legacy devices, and running tabletop exercises to ensure your engineering and legal teams can actually draft and submit an ENISA report within a 24-hour window.