The EU Cyber Resilience Act (CRA) hits two milestones in 2026 that connected fitness and smart health device brands cannot defer. On June 11, 2026, EU member states must designate their national market surveillance and notified bodies — the structural readiness step for CRA enforcement. On September 11, 2026, Article 14 vulnerability and incident reporting obligations come into force. From that date, manufacturers and importers of connected devices — including smart fitness equipment, wearables, health trackers and any product with a network interface or digital component — must have vulnerability disclosure processes operational and must report exploited vulnerabilities to ENISA within 24 hours of becoming aware.

Connected fitness devices sit squarely within CRA scope. Smart watches, fitness trackers, GPS running computers, connected training equipment, heart rate monitors with Bluetooth or Wi-Fi interfaces, smart scales, and any sports device that connects to a network, app or cloud service is a "product with digital elements" under the CRA framework. US brands selling these products into the EU via Amazon EU, Decathlon, Intersport, or any other EU marketplace or retail channel are classified as importers for CRA purposes — the importer obligation applies regardless of whether the brand has EU physical presence. Article 14's reporting requirements are not abstract: they require a documented internal process for identifying vulnerabilities, assessing their severity, notifying ENISA within 24 hours, and informing users and marketplace operators of the risk and available mitigation.

The December 2027 full CRA compliance deadline covers the broader set of security requirements — vulnerability management throughout the product lifecycle, security documentation, conformity assessment and CE marking for CRA purposes. September 11 is the immediate operational priority: the vulnerability reporting infrastructure must be in place, not underway. Brands that have not yet assessed which of their EU-market connected fitness products fall within CRA scope should treat June 11 — the member state designation date — as the working deadline for that scoping exercise, leaving time to build the Article 14 reporting process before September 11.

• CRA Article 14 vulnerability and incident reporting obligations effective September 11, 2026 — 24-hour ENISA notification required for exploited vulnerabilities in connected devices on the EU market
• Connected fitness devices in scope: smart watches, fitness trackers, GPS computers, connected training equipment, heart rate monitors with network interfaces — any device with digital connectivity
• US brands selling connected fitness devices into the EU are classified as importers for CRA purposes — no EU physical presence required to be in scope
• June 11, 2026 — EU member state CRA national body designations. Use this date as the target for completing product scope assessment
• Full CRA compliance (security documentation, conformity assessment, CE marking) deadline is December 2027 — but Article 14 reporting infrastructure must be operational from September 11, 2026

CRA is not a one-off compliance filing — it is an ongoing product security obligation that runs for the life of the product on the EU market. Article 14's September 11 reporting requirement is the most immediately actionable piece of a larger framework. Expandly includes CRA obligation mapping in EU market entry compliance planning for connected device brands — alongside the Battery Regulation, Right to Repair and GPSR requirements that apply in parallel to the same product categories.