EU CRA September Deadline: What US Electronics Brands Must Have in Place

EU Cyber Resilience Act milestone applies from September 11, 2026. From that date, manufacturers of connected products sold in the EU must notify ENISA of any actively exploited vulnerability within 24 hours. US electronics brands without an EU-based Authorised Representative and vulnerability disclosure process face non-conformity penalties of up to 15 million euros.
Six EU Regulations Converging on Electronics Hardware in 2026 – The Complete Compliance Timeline

Six EU regulations land new obligations on consumer electronics hardware between April and September 2026: the Battery Regulation, ESPR Digital Product Passport, Right to Repair, AI Act, PPWR and Cyber Resilience Act. Each is independent, none covers the others, and there is no exemption for US brands without an EU presence.