DEPLOYDatabase

Regulation · Other

EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027

Regulation (EU) 2024/2847 sets cybersecurity requirements for products with digital elements, meaning hardware or software that connects directly or indirectly to a network. It entered into force on 10 December 2024. Manufacturer reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026 (covering in-scope products already on the market), and most other obligations, including the essential cybersecurity requirements for products, apply from 11 December 2027.

Status: in force, phased application. Applicability: connected robots (humanoids, AMRs, delivery robots and their companion apps and cloud links) placed on the EU market fall within scope unless a sector exclusion applies, so they need secure-by-design development, vulnerability handling and incident reporting. Verified on 2026-10-26.

Jurisdiction: European Union · Effective 2027-12-11

Machine-readable surfaces

Sources (2)

  1. EU Cyber Resilience Act · https://ncsc.gov.ie/cra/
  2. EU Cyber Resilience Act 24-hour reporting duties start September 11, 2026 · https://www.jonesday.com/en/insights/2026/07/eu-cyber-resilience-act-24hour-reporting-duties-start-september-11-2026

Common questions

What does EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 cover?
Regulation (EU) 2024/2847 sets cybersecurity requirements for products with digital elements, meaning hardware or software that connects directly or indirectly to a network. It entered into force on 10 December 2024. Manufacturer reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026 (covering in-scope products already on the market), and most other obligations, including the essential cybersecurity requirements for products, apply from 11 December 2027. Status: in force, phased application. Applicability: connected robots (humanoids, AMRs, delivery robots and their companion apps and cloud links) placed on the EU market fall within scope unless a sector exclusion applies, so they need secure-by-design development, vulnerability handling and incident reporting. Verified on 2026-10-26.
Where does EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 apply?
EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is recorded as a other applying in European Union on the DEPLOY registry.
When did EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 take effect?
EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is recorded as effective December 11, 2027 on the DEPLOY registry.
Is EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 still in effect?
EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is currently in effect and applies to covered operators in the named jurisdiction.
What types of robots does EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 apply to?
EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is recorded as applying to humanoid robots, quadruped robots, service robots and 3 other form factors on the DEPLOY registry.
Which robot models on the DEPLOY registry fall under EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027?
8 robot models on the DEPLOY registry match the form-factor scope of EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027: 10Beauty Manicure System, 3D Tissue Braiding Platform, 4NE-1, 7 Series DPO Oscilloscope and 4 others. Form-factor scope match does not by itself establish compliance status; review the underlying primary sources for each operator.
Methodology: Unreviewed · 2 sources (no primary) · last reviewed 2026-10-26

Verification posture

Unreviewed

Low confidence

Review state

Stable

Last reviewed 2026-10-26

Architectural position

Cohort: humanoid

Sources by quality tier

2
unclassified
Unclassified source

The framework is documented at /methodology. Corrections at /corrections. Reviewer: DEPLOY editorial team.

Methodology surface for EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027.

Canonical ID 078af31c-2664-4ebe-979d-2a797d894034