{"id":"078af31c-2664-4ebe-979d-2a797d894034","slug":"eu-cyber-resilience-act-2024-2847","kind":"other","headline":"EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027","summary":"Regulation (EU) 2024/2847 sets cybersecurity requirements for products with digital elements, meaning hardware or software that connects directly or indirectly to a network. It entered into force on 10 December 2024. Manufacturer reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026 (covering in-scope products already on the market), and most other obligations, including the essential cybersecurity requirements for products, apply from 11 December 2027. Status: in force, phased application. Applicability: connected robots (humanoids, AMRs, delivery robots and their companion apps and cloud links) placed on the EU market fall within scope unless a sector exclusion applies, so they need secure-by-design development, vulnerability handling and incident reporting. Verified on 2026-10-26.","locationId":"1f672777-9422-4b11-8e4d-4fd9e8209c30","effectiveAt":"2027-12-11T00:00:00.000Z","expiresAt":null,"reviewStatus":"unreviewed","formFactors":["humanoid","quadruped","service","delivery","sidewalk","other"],"jurisdiction":"EU","complianceDeadline":null,"enforcementEvents":null,"aliases":[],"collisionRisk":"none","reviewNote":null,"createdAt":"2026-10-26T19:59:15.712Z","updatedAt":"2026-10-26T20:00:33.095Z","location":{"id":"1f672777-9422-4b11-8e4d-4fd9e8209c30","name":"European Union","slug":"european-union","kind":"region","parentLocationId":null,"region":"Europe","lat":54.526,"lng":15.2551,"reviewStatus":"reviewed","aliases":[],"collisionRisk":"high","reviewNote":null,"createdAt":"2026-05-31T13:17:45.465Z","updatedAt":"2026-07-04T13:32:35.092Z"},"derived":{"status":"in_effect"},"sources":[{"id":"5ed119ec-f1ce-45e8-820a-912761c26b39","regulationId":"078af31c-2664-4ebe-979d-2a797d894034","url":"https://ncsc.gov.ie/cra/","label":"EU Cyber Resilience Act","publishedAt":null,"notes":null,"title":"EU Cyber Resilience Act","sourceName":"National Cyber Security Centre (Ireland)","mediaType":"article","videoId":null,"channel":null,"durationSec":null,"timestampSec":null,"createdAt":"2026-10-26T19:59:16.438Z","updatedAt":"2026-10-26T19:59:16.438Z"},{"id":"6d2674eb-1951-4c35-a615-9bd175a4f102","regulationId":"078af31c-2664-4ebe-979d-2a797d894034","url":"https://www.jonesday.com/en/insights/2026/07/eu-cyber-resilience-act-24hour-reporting-duties-start-september-11-2026","label":"EU Cyber Resilience Act 24-hour reporting duties start September 11, 2026","publishedAt":null,"notes":null,"title":"EU Cyber Resilience Act 24-hour reporting duties start September 11, 2026","sourceName":"Jones Day","mediaType":"article","videoId":null,"channel":null,"durationSec":null,"timestampSec":null,"createdAt":"2026-10-26T19:59:17.210Z","updatedAt":"2026-10-26T19:59:17.210Z"}],"statusEvents":[],"jsonLd":{"@context":"https://schema.org","@type":"Legislation","@id":"https://registry.deploy.report/regulations/eu-cyber-resilience-act-2024-2847","url":"https://registry.deploy.report/regulations/eu-cyber-resilience-act-2024-2847","name":"EU Cyber Resilience Act (Regulation (EU) 2024/2847): vulnerability reporting from 11 September 2026, full product requirements from 11 December 2027","description":"Regulation (EU) 2024/2847 sets cybersecurity requirements for products with digital elements, meaning hardware or software that connects directly or indirectly to a network. It entered into force on 10 December 2024. Manufacturer reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026 (covering in-scope products already on the market), and most other obligations, including the essential cybersecurity requirements for products, apply from 11 December 2027. Status: in force, phased application. Applicability: connected robots (humanoids, AMRs, delivery robots and their companion apps and cloud links) placed on the EU market fall within scope unless a sector exclusion applies, so they need secure-by-design development, vulnerability handling and incident reporting. Verified on 2026-10-26.","identifier":"078af31c-2664-4ebe-979d-2a797d894034","legislationDate":"2027-12-11T00:00:00.000Z","legislationApplies":{"@type":"Place","name":"European Union"},"publisher":{"@id":"https://deploy.report/#organization"}},"framework_metadata":{"framework_schema_version":"0.1.0","verification_status":"unreviewed","maturity_stage":null,"lifecycle_state":null,"architectural_position":{"cohort":null,"sub_cohorts":[]},"within_cohort_verified_vs_claimed_pair":null,"cap_flags":[],"verification_depth":{"sources_count":2,"primary_source_types":[]}}}