Login

|

Register

  • Home

    • Amazon FBA Support

      Amazon handed prep work back to sellers, and the consequences of getting it wrong land on you rather than on them. A carton that arrives wrong gets refused, refused stock sits somewhere earning nothing, and a launch date moves.

      Amazon FBM Support

      FBM keeps the things worth keeping. Your packaging, customer data & margin. It also puts Amazon’s performance metrics directly on your dispatch times, which is a comfortable trade at home and a much harder one from four thousand miles away.

      Direct-to-Consumer Fulfilment

      On a marketplace, a slow delivery is the marketplace’s fault. On your own store it is yours. The box that arrives, the day it arrives and how easy it is to send back are all part of what someone bought, and they decide whether a first order becomes a second one.

      Returns, Reworks & Recycling

      Treated as a cost, a return is written off twice, once on the refund and again on the unit. Treated as inventory, a lot of it goes back on sale. What decides which of those happens is how quickly the unit gets looked at and how far it had to travel to be looked at.

      Warehouse Location

      Stock held inside the market it sells into arrives as a domestic delivery. No customs event on the order, and nothing for your customer to settle before the courier hands the parcel over. Ours sits in the UK, the Netherlands and the US, which covers...

  • Contact Us

Expandly Blog

EU Cyber Resilience Act June 2026: What Consumer Electronics Brands Must Do Before June 11

June 11 is when CRA mandatory incident reporting obligations begin. For any brand with connected products on the EU market, the first enforcement mechanism is now active.

In This Article

01What the CRA requires
02What changes on June 11, 2026
03The full CRA timeline
04Which brands are most exposed

Key Takeaways

►CRA incident reporting mandatory from June 11, 2026: 24 hours for exploited vulnerabilities
►Vulnerability disclosure obligations follow August 11, 2026
►Full product cybersecurity compliance deadline: December 11, 2027
►Most consumer electronics are Class I (self-assessment) but classification must be confirmed now

The EU Cyber Resilience Act was published in October 2024. Most consumer electronics brands have been treating it as a future problem. It becomes a current one on June 11, 2026, when the first mandatory reporting obligations take effect.

June 11, 2026 CRA mandatory incident reporting effective date. Source: EU Cyber Resilience Act

The Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements sold in the EU. That scope covers a wide range of consumer electronics: smart home devices, connected fitness equipment, routers, cameras, wearables, gaming devices, and any product that connects to a network or another device.

June 11 is when CRA incident reporting obligations become mandatory. Manufacturers and importers must report actively exploited vulnerabilities to ENISA, the EU Agency for Cybersecurity, within 24 hours of discovery. Severe incidents must be notifiable within 72 hours. Brands that have not established a vulnerability monitoring and reporting process for their EU-facing products are already behind the curve.

Incident reporting is the June 2026 milestone. The vulnerability disclosure requirement, a separate public notification obligation for discovered vulnerabilities, takes effect August 11, 2026. Full product compliance, requiring all new products placed on the EU market to meet CRA security requirements, is December 11, 2027.

Any US consumer electronics brand with connected products on the EU market has CRA obligations. The practical question is classification: the CRA creates three risk tiers, with different conformity assessment routes for each. Class I (default, self-assessment) covers most consumer products. Class II (third-party assessment) applies to higher-risk categories including network devices and industrial control systems. Getting your product classification right now determines how much lead time you have for conformity assessment before December 2027.

ENISA's expectation is that brands with connected products have a vulnerability disclosure policy, an internal incident classification procedure, and a named reporting contact before June 11. The 24-hour incident reporting requirement mirrors the GDPR data breach notification framework. Like GDPR, the expectation is that companies have invested in the monitoring infrastructure before the obligation takes effect.

The December 2027 deadline gets more coverage. June 11 is the date that matters now.

Expandly helps US ecommerce brands expand into Europe — compliance, marketplaces and fulfilment, all handled. We’ve supported 2,000+ brands make the move.

Find out more
  • EPR compliance managed from day one — packaging, WEEE, batteries and beyond
  • Product label review and Responsible Person service for EU and UK market entry
  • EU fulfilment from our Netherlands warehouse — fast access to the whole continent
  • Dedicated onboarding, compliance and success team alongside the platform
  • 17 years' experience, 2,500+ brands expanded — Andy Hooper, Founder

The bigger picture

EU cybersecurity regulation and the extraterritorial reach for US brands

The Cyber Resilience Act is the EU's first horizontal cybersecurity regulation for products. Previous rules addressed specific sectors without a unified product-level framework. The CRA creates a uniform baseline across all product categories with digital elements sold in the EU, meaning consumer electronics are subject to the same cybersecurity standard as connected industrial equipment in the same risk class. For US consumer electronics brands, the CRA also has an extraterritorial dimension. Products manufactured in the US but sold in the EU through any channel, including Amazon, direct to consumer, or wholesale to EU retailers, are within CRA scope if they have digital elements. In the absence of an EU-established importer, the non-EU manufacturer bears the obligations directly. The December 2027 product compliance deadline is the major design and engineering challenge. Building CRA-compliant cybersecurity into connected products from design stage is the approach that meets the requirement without late-stage product redesign costs.

  • Brands with connected products need a vulnerability disclosure policy, incident classification procedure, and ENISA reporting contact before June 11
  • The importer (the EU-established entity that first places the product on the EU market) shares CRA obligations with the manufacturer
  • Class I products require self-assessment; Class II requires third-party assessment from a Notified Body

Incident reporting deadline

From June 11, 2026, actively exploited vulnerabilities in EU-market connected products must be reported to ENISA within 24 hours of discovery.

24 hours

EU CRA Article 14

Full compliance deadline

Full product CRA compliance is required for all new consumer electronics placements on the EU market from December 11, 2027. The conformity assessment process takes 12-18 months for most product categories.

December 11, 2027

EU CRA

Compliance-First Onboarding

For electronics brands, Expandly begins with CE marking scope and product audit before market setup. From there, VAT registration, marketplace setup and EU-local fulfilment follow in the right order.

2,000+

brands expanded with Expandly

If this sounds like your world,
let's talk.

Expandly helps US ecommerce brands expand into Europe — compliance, marketplaces and fulfilment, all handled.

Self-Serve

  • £1,150/month
  • Platform-led with email support
  • Best for: $1M–$5M brands

Guided

  • £3,000/month
  • Dedicated Account Manager
  • Best for: $5M–$20M brands

VIP

  • £5,000/month
  • Dedicated VIP Consultant
  • Best for: $20M–$50M+ brands
See full pricing and what's included