Topic: regulation
-
Preparing a manufacturer's CRA vulnerability workflow: intake, evidence and reporting clocks
A proposed preparation protocol connects vulnerability intake and component records to the CRA reporting decision. It separates the reporting duty already applicable in 2026 from the wider vulnerability handling requirements applicable in December 2027.
-
CRA reporting since September 2026: triggers, deadlines and the Single Reporting Platform
The CRA requires manufacturers to report actively exploited product vulnerabilities and severe product security incidents. Both have 24-hour and 72-hour stages, but their final reports run from different events.
-
Swiss cyberattack reporting and the CRA: different duties for operators and product manufacturers
Swiss critical-infrastructure reporting concerns qualifying cyberattacks on covered operators. The CRA concerns product manufacturers supplying the EU market, including Swiss manufacturers; similar early deadlines do not make the recipients or reporting triggers interchangeable.
-
CRA and open source: distinguishing contributors, manufacturers and stewards
An open-source licence does not by itself determine CRA duties. The regulation distinguishes commercial product supply, contributions to software outside a contributor's responsibility, and sustained support by open-source software stewards, whose Article 24 duties start in December 2027.
Machine-readable: JSON