Login

|

Register

  • Home

    • Amazon FBA Support

      Amazon handed prep work back to sellers, and the consequences of getting it wrong land on you rather than on them. A carton that arrives wrong gets refused, refused stock sits somewhere earning nothing, and a launch date moves.

      Amazon FBM Support

      FBM keeps the things worth keeping. Your packaging, customer data & margin. It also puts Amazon’s performance metrics directly on your dispatch times, which is a comfortable trade at home and a much harder one from four thousand miles away.

      Direct-to-Consumer Fulfilment

      On a marketplace, a slow delivery is the marketplace’s fault. On your own store it is yours. The box that arrives, the day it arrives and how easy it is to send back are all part of what someone bought, and they decide whether a first order becomes a second one.

      Returns, Reworks & Recycling

      Treated as a cost, a return is written off twice, once on the refund and again on the unit. Treated as inventory, a lot of it goes back on sale. What decides which of those happens is how quickly the unit gets looked at and how far it had to travel to be looked at.

      Warehouse Location

      Stock held inside the market it sells into arrives as a domestic delivery. No customs event on the order, and nothing for your customer to settle before the courier hands the parcel over. Ours sits in the UK, the Netherlands and the US, which covers...

  • Contact Us

Expandly Blog

EU Cyber Resilience Act: Connected Product Brands Have Until September 11

From that date, any actively exploited vulnerability in an EU-sold connected product must be reported to ENISA within 24 hours. The infrastructure to do this needs to be in place now.

In This Article

01What the September 11 milestone requires
02Which products fall under the CRA
03The 24-hour and 72-hour notification windows
04Who the obligation applies to — including US brands
05Building the vulnerability reporting infrastructure

Key Takeaways

►Active vulnerability reporting required from 11 September
►24 hours to notify ENISA of actively exploited vulnerability
►Applies to all connected products sold in the EU
►US manufacturers selling to EU fall within scope

The EU Cyber Resilience Act's September 11, 2026 milestone requires manufacturers of connected products sold in the EU to have active vulnerability reporting systems in place. From that date, any actively exploited vulnerability must be reported to ENISA within 24 hours of discovery.

24 hours initial ENISA notification window for actively exploited vulnerabilities from 11 September 2026 — 72 hours for a full notification (Source: EU Cyber Resilience Act / Hogan Lovells)

The CRA applies to all products with digital elements sold in the EU: smart home devices, wearables, IoT accessories, connected fitness equipment, and any consumer electronics with network connectivity. US-headquartered manufacturers selling into the EU are within scope regardless of where they are based. The regulation covers the product while it is on the EU market, not just at the point of first sale.

The September 11 milestone is the vulnerability reporting obligation within the CRA's phased implementation. It is not the final compliance date for the full regulation, but it is the milestone that requires active operational infrastructure rather than policy documentation. From 11 September, brands must be able to receive a vulnerability disclosure, assess whether active exploitation is occurring, and file the ENISA notification within 24 hours. The full notification is due within 72 hours.

That process cannot be built on the day a vulnerability is discovered. It requires a disclosure intake mechanism, a triage protocol, a named owner for ENISA notifications, and training on the notification format and timeline. Brands that do not have this infrastructure in place before September 11 face non-conformity enforcement from Q4 2026, with EU market access implications for products that remain non-compliant beyond the enforcement window.

  • CRA September 11 milestone: active vulnerability reporting systems required for all connected products sold in the EU
  • 24-hour window: initial ENISA notification required for any actively exploited vulnerability discovered in an EU-sold product
  • 72-hour window: full vulnerability notification to ENISA with complete details
  • Applies to US manufacturers selling connected products in the EU, regardless of headquarters location

There is enough time to build this infrastructure if the work starts now. It is not enough time if the first discussion happens when a vulnerability is discovered in September.

Expandly helps US ecommerce brands expand into Europe — compliance, marketplaces and fulfilment, all handled. We’ve supported 2,000+ brands make the move.

Find out more
  • Dedicated onboarding, compliance and success team alongside the platform
  • 17 years' experience, 2000+ brands expanded — Andy Hooper, Founder

The bigger picture

EU digital product compliance now includes active security obligations

The CRA shifts the EU compliance picture for electronics brands from a product certification question to an ongoing security management obligation. It's not enough to get CE marking and declare conformity — CRA requires that brands actively monitor, receive and report on security vulnerabilities throughout the product's life on the EU market. For US brands with connected products entering the EU, this is a new class of compliance infrastructure that sits alongside the product standards setup rather than replacing it.

  • Establish a vulnerability disclosure intake process before September 11 — email address, triage protocol, documented response timeline
  • Identify who in your organization is responsible for ENISA notifications and train them on the 24-hour and 72-hour window requirements
  • If you don't have an EU-based compliance representative, this needs to be in place before September — the ENISA reporting obligation requires a point of contact in the EU regulatory system

ENISA Initial Notification Window

From 11 September 2026, any actively exploited vulnerability in an EU-sold connected product must trigger ENISA notification within this window

24 hours

Source: EU Cyber Resilience Act / Hogan Lovells

CRA September 11 Milestone

Active vulnerability reporting infrastructure must be established before the CRA milestone takes effect on September 11, 2026

11 Sep 2026

Source: EU Cyber Resilience Act implementation timeline

EU Responsible Person, Included

Cosmetics, supplements and electronics sold in the EU require a designated Responsible Person. Expandly provides this designation as part of your compliance setup, with no separate service or third party required.

2,000+

brands expanded with Expandly

If this sounds like your world,
let's talk.

Expandly helps US ecommerce brands expand into Europe — compliance, marketplaces and fulfilment, all handled.

Self-Serve

  • £1,150/month
  • Platform-led with email support
  • Best for: $1M–$5M brands

Guided

  • £3,000/month
  • Dedicated Account Manager
  • Best for: $5M–$20M brands

VIP

  • £5,000/month
  • Dedicated VIP Consultant
  • Best for: $20M–$50M+ brands
See full pricing and what's included