What has already changed
- Reporting is mandatory. Since 11 September 2026 the manufacturer must report actively exploited vulnerabilities and severe incidents simultaneously to the coordinating CSIRT and to ENISA: early warning within 24 hours, notification within 72 hours, final report within 14 days of the fix (vulnerabilities) or within one month of the notification (incidents). The obligation also covers products placed on the market before that date.
- The ENISA single platform is live. ENISA has launched the first version of the Single Reporting Platform, with manuals, FAQs and a help desk; some functions, such as voluntary reporting, will come later.
- In Italy the ACN will be the supervisory authority. On 2 October 2026 the Council of Ministers gave preliminary approval to the draft decree adapting national law to the Regulation, which entrusts the National Cybersecurity Agency (ACN) with market surveillance and the notification of conformity assessment bodies. The text is not yet final.
- Harmonised standards are not ready yet. Standardisation work has slipped by two months and, from the information available, no standard has yet been cited in the Official Journal of the European Union. For class I products this means that self-assessment is not enough today.
Five things to do before 11 December 2027
- Classify the portfolio. Which products are covered, whether they are without a class, important class I or II, or critical, and whether the company is a manufacturer, importer or distributor. The conformity route depends on this.
- Secure the reporting process, already mandatory. Who detects an exploited vulnerability, who decides, who accesses the ENISA platform, how users are informed. It is worth testing it with an exercise.
- Build vulnerability management. SBOM covering at least top-level dependencies, monitoring of components, a coordinated disclosure policy with a public contact point, free security updates.
- Carry out the gap analysis product by product against the essential requirements of Annex I and set the support period, at least five years unless the expected use time is shorter.
- Plan conformity: technical documentation, EU declaration, user information and, for the classes that require it, the notified body, to be contacted in good time.
The timeline
| Date | What |
|---|---|
| 11 June 2026 | Rules on conformity assessment bodies |
| 11 September 2026 | Reporting obligations (Art. 14), including for products already on the market |
| 11 December 2027 | Essential requirements, conformity assessment, documentation, CE marking, penalties |
How we can help
We classify products, set up the reporting process and vulnerability management, and support conformity all the way to CE marking. The work is based on Prometeo, which holds the product inventory, the assessment of requirements by product, the SBOM, the register of vulnerabilities and notifications, and drafts of the required documents.
The Cyber Resilience Act in detail →Sources
Regulation (EU) 2024/2847, Arts. 14, 69 and 71; ENISA, Single Reporting Platform (DIMT news item, 14 September 2026; cyberresilienceact.eu, update of 11 September 2026); Council of Ministers press release no. 191 of 2 October 2026 and commentary by ICT Security Magazine and Cybersecurity360 (October 2026); cyberresilienceact.eu on the delay to the harmonised standards. Sources consulted on 3 November 2026.