EU CRA September Deadline: What US Electronics Brands Must Have in Place

EU Cyber Resilience Act milestone applies from September 11, 2026. From that date, manufacturers of connected products sold in the EU must notify ENISA of any actively exploited vulnerability within 24 hours. US electronics brands without an EU-based Authorised Representative and vulnerability disclosure process face non-conformity penalties of up to 15 million euros.