The Cyber Resilience Act (CRA) is entering a decisive phase. While a full application is expected in December 2027, the first concrete obligations arrive in September 2026. From that date, manufacturers of products with digital elements will be required to report actively exploited vulnerabilities and severe security incidents affecting their products, both software and
hardware.
This marks an important shift from preparation to implementation. Compliance will depend on capabilities that must already be in place before an incident occurs: monitoring systems,
vulnerability-management processes, and clear internal procedures for assessing and reporting security events. It also requires visibility across software supply chains, including third-party and open-source components, as vulnerabilities affecting suppliers may quickly create obligations for downstream organisations.
Another important development is that ENISA’s CRA Single Reporting Platform (SRP), the centralised reporting system established under the Cyber Resilience Act, is expected to be operational by 11 September 2026. The platform will serve as a single entry point for manufacturers to report actively exploited vulnerabilities and severe incidents to the relevant
CSIRT and ENISA, significantly simplifying reporting obligations across the EU.
The challenge for SMEs
For many SMEs, the transition will not be straightforward. Recent ENISA research, published in the SME CRA Survey Report, shows that awareness of the CRA is growing, but confidence in understanding and implementing its requirements remains limited. ENISA has also released the SME Cyber Resilience Maturity Assessment Model, a practical self-check tool to help SMEs assess governance, secure design, vulnerability management, product life-cycle practices and staff skills in preparation for the CRA. Areas such as incident response, product security management and compliance documentation are often underdeveloped, particularly in smaller organisations facing resource and skills constraints.
As a result, the challenge is not only understanding the regulation but also translating it into practical and sustainable processes. Many smaller organisations must balance cybersecurity requirements with limited budgets, limited specialist expertise and competing business priorities.
Compliance as a business advantage
The CRA should not be viewed solely as a regulatory burden. Organisations that can demonstrate structured vulnerability management, secure development practices and effective incident reporting will be better prepared to meet the expectations of customers, authorities and supply chain partners.
In practice, this means building capabilities that support both regulatory readiness and more reliable product security across European digital value chains.
Where ACCOMPLISH fits in
This is where ACCOMPLISH can help. The project focuses on translating regulatory requirements into practical support for organisations, particularly SMEs. Through research, methodologies, tools and collaboration with industry stakeholders, ACCOMPLISH aims to make cybersecurity compliance more achievable for organisations with limited resources.
By promoting practical and shareable approaches, the project helps bridge the gap between understanding the CRA and implementing it effectively. Rather than treating compliance as a stand-alone exercise, ACCOMPLISH supports developing capabilities that strengthen both regulatory readiness and long-term cyber resilience.
Looking ahead
September 2026 is only the first milestone on the road to full CRA compliance, but it is an important one. Organisations that begin preparing now by reviewing their products, supply chains and vulnerability-management processes will be in a much stronger position when reporting obligations take effect. At the same time, the launch of ENISA’s CRA Single Reporting
Platform will provide the operational infrastructure needed to support these new reporting requirements across the European Digital Single Market.
By CEFRIEL
