August 9, 2026

Newsletter

The European Post

Policy • Diplomacy • Strategic Insight

LATEST
New EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before AntalyaNew EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before Antalya
August 9, 2026

Newsletter

The European Post

Policy • Diplomacy • Strategic Insight

LATEST
New EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before AntalyaNew EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before Antalya

Connected Devices Get a Firm New Deadline to Report Their Flaws

Anders Oftebro
Legislative Tracker, Enlargement

Athens: The countdown that manufacturers of internet-connected products have watched warily for two years is entering its decisive phase. Under the Cyber Resilience Act, which took effect in December 2024, the first hard obligations are now landing on a fixed calendar, and the most demanding of them is barely a hundred days away.

From 11 September, makers of products with digital elements, a category that stretches from smart doorbells and routers to industrial sensors and software libraries, must notify authorities of actively exploited vulnerabilities and severe incidents. The clock is unforgiving. An initial alert is due without undue delay and in any case within 24 hours of the manufacturer becoming aware, a follow-up within 72 hours, and a final report either within 14 days of a fix becoming available for an exploited vulnerability or within a month of the 72-hour update for a severe incident. Reports flow to national authorities and the EU cybersecurity agency through a shared platform.

The reporting regime is only the leading edge. Since 11 June the provisions governing how conformity assessment bodies are notified have applied, laying the institutional plumbing that will later certify whether products meet the Act’s security requirements. Those substantive requirements, covering secure design, vulnerability handling and security updates across a product’s expected lifetime, become binding on 11 December 2027, giving industry a runway to redesign hardware and firmware.

For manufacturers the immediate task is organisational rather than technical. Meeting a 24-hour notification duty demands monitoring systems that can detect exploitation quickly, legal and engineering staff who can classify an incident under pressure, and rehearsed procedures for filing within jurisdictions that have little tolerance for delay. Firms accustomed to disclosing flaws on their own timetable, or not at all, face a cultural adjustment as much as a compliance one.

The reach of the rules extends well beyond European borders. A component supplier in Asia or a software vendor in North America that places products on the EU market falls within scope, which is why the Act is already influencing product security practices globally. Open-source maintainers, initially alarmed that volunteer projects might shoulder corporate-style duties, secured lighter treatment, though the boundaries of those carve-outs will be tested in practice.

Regulators frame the law as a response to a market that has long rewarded speed to release over security, leaving households and businesses exposed to devices that ship with known weaknesses and receive no updates. Critics warn that aggressive reporting timelines could flood authorities with alerts of uneven quality, and that smaller manufacturers may struggle with the administrative load. The next test comes in September, when the first mandatory disclosures reveal whether Europe’s ambition to make connected products secure by design translates into a workable routine or a paperwork bottleneck.

Comments