Speaker: Cortez Frazier Jr.  

The first wave of Cyber Resilience Act (CRA) obligations takes effect on Sept. 11, 2026: Article 14's requirement to report (within a period of hours, not weeks) actively exploited vulnerabilities and severe incidents to ENISA and national CSIRTs. The more substantive requirements kick in next year (December of 2027), meaning many organizations are managing a mix of ongoing compliance activities with preparation for what comes next.

Over the last months, our team at FOSSA (a software security and compliance vendor) has supported a range of organizations as they’ve implemented infrastructure to facilitate CRA compliance: standing up disclosure workflows, wrestling with the ""actively exploited"" threshold, assembling reports, and building th ...