EU Cyber Resilience Act's 24-Hour Reporting Requirement Now Enforced for IoT Vendors
The EU CRA's vulnerability-reporting regime became active September 11, 2026, requiring IoT manufacturers to report exploited vulnerabilities within 24 hours or face penalties.

