Dispatches
CRA Article 14 defines the reporting clock. But another interval matters first: how long does it take an organisation to recognise that an ordinary operational signal may have become a regulatory question?
A legacy recall still in service, certified safety footwear failing market checks, and a new cyber reporting clock all expose the same weakness: controls must continue to work.
Connected products do not remain in one cybersecurity state. Updates, dependencies, support conditions and installed-base divergence mean assurance must be governed throughout the lifecycle
From 11 September 2026, the Cyber Resilience Act begins creating a timed regulatory record of what manufacturers know about actively exploited vulnerabilities and severe security incidents. That evidence may later matter far beyond cybersecurity compliance.