The EU CRA's Real Question: What Shipped, and When Did You Know?
ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.
An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.
- CRA Article 14: 24-hour ENISA early warning and 72-hour full report for actively exploited flaws.
- Engineering requirements deferred to December 11, 2027, creating a 15-month visibility-only runway.
- Article 13 requires the SBOM to remain current, unlike stale EO 14028-era compliance artifacts.
- 98% of applications contain open source components, extending CRA scope to nearly all EU vendors.
- Mitigation options: automated SBOM pipelines or curated, attested open source catalogs.
- Vendors
- ActiveState
- Products
- ActiveState Curated Catalogs
- Organizations
- ENISAEuropean CommissionEU Cyber Resilience Act
- Countries
- European Union
From the original article
5 min read at bleepingcomputer.com
The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws. ActiveState explains why knowing exactly what shipped and when vulnerabilities were discovered will be critical to meeting the new requirements. [...]
By Sponsored by ActiveState · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.