The reporting clock
The reporting clock: 24h early warning, 72h notification, 14-day/1-month final reports — live since Sep 11, 2026.
Free field guide · PDF
EU Cyber Resilience Act2026 Field Guide
The reporting clock, the device exclusion, and the boundary cases — with the cybersecurity practice you need.
- Reporting
- 24h
- Excluded
- Devices
- Full apply
- Dec 2027
Sourced from verified 2026 publications.
Download the free guide
Enter your work email and we'll send the PDF straight to your inbox.
What's inside
Five pages, zero fluff
Every figure in this guide traces to a named source — verified 2026 publications.
The device exclusion
The device exclusion: medical devices sit under MDR/IVDR — your MDR cybersecurity program is your EU regime.
The boundary cases
The boundary cases: separately marketed software components and open-source stacks can fall in scope.
Sources & scope
- mondaq.com, EU Cyber Resilience Act: First Reporting Obligations Take Effect Today (Sep 2026).
- dev.to, The EU Cyber Resilience Act Takes Effect in One Week.
- aestechno.com, Cyber Resilience Act 2026: IoT and Embedded Compliance Guide.
This guide is market-access intelligence, not regulatory or legal advice. The CRA's scope boundaries, reporting procedures, and enforcement practice change — professional review is required before business use.
Market Access Strategy Session
Connected product on your 2026 roadmap? Start with the full picture.
A Market Access Strategy Session maps your cybersecurity route — CRA boundary analysis, MDR security obligations, and disclosure planning.
Professional review is required before business use.
Back to ghmap.io Questions? Talk to our team