_Regulation · Other_

# EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027

Canonical ID: `078af31c-2664-4ebe-979d-2a797d894034`

- **Jurisdiction:** [European Union](/locations/european-union.md) (id: `1f672777-9422-4b11-8e4d-4fd9e8209c30`)
- **Kind:** `other`
- **Status (derived):** in_effect
- **Effective:** 2027-12-11

Regulation (EU) 2024/2847 sets cybersecurity requirements for products with digital elements, meaning hardware or software that connects directly or indirectly to a network. It entered into force on 10 December 2024. Manufacturer reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026 (covering in-scope products already on the market), and most other obligations, including the essential cybersecurity requirements for products, apply from 11 December 2027. Status: in force, phased application. Applicability: connected robots (humanoids, AMRs, delivery robots and their companion apps and cloud links) placed on the EU market fall within scope unless a sector exclusion applies, so they need secure-by-design development, vulnerability handling and incident reporting. Verified on 2026-10-26.

## Sources (2)

1. **EU Cyber Resilience Act** · https://ncsc.gov.ie/cra/
2. **EU Cyber Resilience Act 24-hour reporting duties start September 11, 2026** · https://www.jonesday.com/en/insights/2026/07/eu-cyber-resilience-act-24hour-reporting-duties-start-september-11-2026

## Common questions

### What does EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 cover?

Regulation (EU) 2024/2847 sets cybersecurity requirements for products with digital elements, meaning hardware or software that connects directly or indirectly to a network. It entered into force on 10 December 2024. Manufacturer reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026 (covering in-scope products already on the market), and most other obligations, including the essential cybersecurity requirements for products, apply from 11 December 2027. Status: in force, phased application. Applicability: connected robots (humanoids, [AMRs](/glossary/amr.md), delivery robots and their companion apps and cloud links) placed on the EU market fall within scope unless a sector exclusion applies, so they need secure-by-design development, vulnerability handling and incident reporting. Verified on 2026-10-26.

### Where does EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 apply?

EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is recorded as a other applying in [European Union](/locations/european-union.md) on the DEPLOY registry.

### When did EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 take effect?

EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is recorded as effective December 11, 2027 on the DEPLOY registry.

### Is EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 still in effect?

EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is currently in effect and applies to covered operators in the named jurisdiction.

### What types of robots does EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 apply to?

EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027 is recorded as applying to humanoid robots, quadruped robots, service robots and 3 other form factors on the DEPLOY registry.

### Which robot models on the DEPLOY registry fall under EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027?

8 robot models on the DEPLOY registry match the form-factor scope of EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027: [10Beauty Manicure System](/models/10beauty-manicure.md), [3D Tissue Braiding Platform](/models/tissue-braiding-platform.md), [4NE-1](/models/neura-4ne-1.md), [7 Series DPO Oscilloscope](/models/tektronix-7-series-dpo.md) and 4 others. Form-factor scope match does not by itself establish compliance status; review the underlying primary sources for each operator.


_API: GET /v1/regulations/078af31c-2664-4ebe-979d-2a797d894034 · sources: /v1/regulations/078af31c-2664-4ebe-979d-2a797d894034/sources · status: /v1/regulations/078af31c-2664-4ebe-979d-2a797d894034/status · canonical URL: /regulations/eu-cyber-resilience-act-2024-2847_