EU Cyber Resilience Act's Single Reporting Platform Goes Live, Forcing Manufacturers to Report Exploited Vulnerabilities Within Tight Deadlines
From 11 September 2026, manufacturers of products with digital elements sold on the EU market must report actively exploited vulnerabilities and severe security incidents to EU authorities via the new Single Reporting Platform, under the EU Cyber Resilience Act (CRA). The obligation applies to products already on sale, not only new ones, and covers smart devices, routers, software and connected industrial systems regardless of where they were made. The remaining CRA rules, including requirements that products be built to be secure, carry the CE marking, and ship with security updates, take effect on 11 December 2027. Businesses pursuing cross-border technology M&A are advised to assess technology, data and AI-related risks early, with robust due diligence and clear contractual protections becoming critical to preserving deal value and securing regulatory approval.
Why this matters
The CRA's Single Reporting Platform activation is the first hard enforcement moment in the regulation's three-year phase-in, moving cybersecurity obligations from aspiration to live legal duty. Because it reaches any product placed on the EU market regardless of origin, UK, US and Asian manufacturers face immediate compliance exposure without needing an EU establishment. The tight incident-reporting deadlines create new operational risk for technology companies, and the obligation covering existing stock, not just new product lines, means remediation programmes must start now. For deal-doers, the CRA adds a material new layer to technology M&A diligence: unidentified reporting failures or unpatched legacy products can erode deal value and attract regulatory scrutiny post-close.
On the Ground
Technology and data privacy lawyers will be advising manufacturer clients on scope assessment, nomination of responsible reporting officers, and incident-response protocols keyed to the Platform's deadlines. M&A practitioners need to build CRA compliance checks into technology diligence workstreams, alongside existing IP, data ownership and AI regulation reviews. Contractual protections, warranties, indemnities and conditions precedent tied to CRA status, will become standard drafting points in tech transactions. A trainee would likely be tasked with mapping a target's product portfolio against the CRA scope definition, flagging connected-device lines, and drafting a diligence questionnaire on existing vulnerability-reporting processes.
Interview prep
Question you might get
“How does the EU Cyber Resilience Act's new Single Reporting Platform change the diligence process for technology M&A?”
Sign up free to see the full answer
A model answer you can lift into an interview — how to frame this story for a partner.
Sign up freeSources
My notes
saved