Expandly Blog

EU CRA September Deadline: What US Electronics Brands Must Have in Place

From September 11, 2026, manufacturers and importers of products with digital elements sold in the EU must report actively exploited vulnerabilities to ENISA within 24 hours. The obligation applies to IoT devices, wearables, smart home products, connected toys, and any hardware with network connectivity.

Key Takeaways

► September 11 reporting: 24 hours to notify ENISA of exploited vulnerability

► US brands without EU Authorised Representative cannot comply

► Scope covers all connected and IoT products sold in EU

► Penalties up to €15M or 2.5% of global annual turnover

The EU Cyber Resilience Act's September 11, 2026 reporting milestone requires manufacturers and importers of products with digital elements to notify ENISA of any actively exploited cybersecurity vulnerability within 24 hours of discovery, and submit a full incident report within 72 hours.

September 11, 2026 CRA vulnerability and incident reporting obligation for manufacturers and importers of connected products sold in the EU. 24-hour ENISA notification mandatory from this date. Source: EU Cyber Resilience Act (EU) 2024/2847.

The Cyber Resilience Act entered into force on December 10, 2024. Main obligations do not apply until December 11, 2027, but two milestones arrive earlier. The June 11, 2026 deadline required member states to designate conformity assessment notifying authorities and has passed. The September 11, 2026 milestone introduces the incident and vulnerability reporting obligation for all manufacturers and importers of products with digital elements.

The scope of the September 11 obligation is broad. It covers any product with a digital element sold into the EU: IoT devices, wearables, smart home products, connected toys, connected accessories, and hardware with network connectivity. For each actively exploited vulnerability discovered in a product, the manufacturer or importer must notify ENISA within 24 hours of discovery. A full incident report must follow within 72 hours. These are binding obligations from September 11, 2026, not aspirational timelines.

The compliance gap for US brands is specific. Without an EU-based Authorised Representative, the reporting obligation cannot be discharged. Without a documented vulnerability disclosure process and assigned internal accountability, the 24-hour window cannot be met in practice. Authorised Representative designations require a service agreement and formal registration. They cannot be put in place at short notice. Penalties for non-conformity reach up to €15M or 2.5% of global annual turnover.

September 11, 2026: CRA vulnerability reporting obligation applies. ENISA notification within 24 hours of discovery is mandatory.
Scope: IoT devices, wearables, smart home products, connected toys, connected accessories, and any hardware with network connectivity sold in the EU.
US brands without an EU-based Authorised Representative cannot meet the reporting obligation from September 11, 2026.
Penalties: up to €15M or 2.5% of global annual turnover for non-conformity.

For US electronics brands setting up EU market operations, designating an EU Authorised Representative is the prerequisite compliance step before the September 11, 2026 deadline. Expandly provides Authorised Representative designation as part of the initial compliance setup.

Expandly helps US ecommerce brands expand into Europe — compliance, marketplaces and fulfilment, all handled. We’ve supported 2,000+ brands make the move.

EPR compliance managed from day one — packaging, WEEE, batteries and beyond
Product label review and Responsible Person service for EU and UK market entry

The bigger picture

CRA signals a broader shift in EU digital product compliance

The CRA is the EU's response to cybersecurity risks in the connected product supply chain, and the September 11 reporting obligation is its first operational requirement for manufacturers. What follows in December 2027 is a full compliance framework covering secure design, vulnerability management, conformity assessment, and CE marking for all products with digital elements. US brands entering the EU electronics market should treat cybersecurity compliance as a market access requirement, not an optional IT consideration. Expandly's compliance setup for electronics brands includes Authorised Representative designation and conformity documentation review before any product reaches the EU market.

The full CRA compliance framework, including secure design requirements and CE marking for digital products, applies from December 11, 2027
Authorised Representative designation for CRA purposes is separate from GPSR Authorised Representative requirements; confirm which obligations apply to each product in your EU range
The September 11 reporting obligation creates an immediate operational requirement for US brands already selling connected products into the EU

CRA penalty exposure

Non-conformity with CRA requirements carries penalties of up to €15M or 2.5% of global annual turnover, whichever is higher. For US brands with significant global revenue, 2.5% of global turnover is the binding ceiling.

€15M

or 2.5% of global annual turnover. Source: EU Cyber Resilience Act (EU) 2024/2847.

EU connected product compliance

CE marking plus WEEE, LVD, EMC, and RED requirements apply alongside CRA for electronics sold in the EU. CRA adds a cybersecurity layer with active reporting obligations from September 11, 2026.

EU directives and regulations applicable to connected electronics. Source: EU Commission.

EU Responsible Person, Included

Cosmetics, supplements and electronics sold in the EU require a designated Responsible Person. Expandly provides this designation as part of your compliance setup, with no separate service or third party required.

2,000+

brands expanded with Expandly

If this sounds like your world,
let's talk.

Expandly helps US ecommerce brands expand into Europe — compliance, marketplaces and fulfilment, all handled.

Global Expansion Pathway™

Where to Expand

Expandly Blog

EU CRA September Deadline: What US Electronics Brands Must Have in Place

In This Article

Key Takeaways

The bigger picture

CRA signals a broader shift in EU digital product compliance

If this sounds like your world, let's talk.

Self-Serve

Guided

VIP

If this sounds like your world,
let's talk.