August 9, 2026

Newsletter

The European Post

Policy • Diplomacy • Strategic Insight

LATEST
New EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before AntalyaNew EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before Antalya
August 9, 2026

Newsletter

The European Post

Policy • Diplomacy • Strategic Insight

LATEST
New EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before AntalyaNew EU Gas Market Rules Take Effect With Consumer SafeguardsDeforestation Regulation Holds Its December Deadline Despite CutsDigital Omnibus Delays Europe’s High-Risk AI Deadline to 2027Europe’s Schools Confront a Widening Basic Skills GapRule of Law Report Finds Progress but Trust Still LagsIRIS2 Gains 66 Satellites as Brussels Signs the Rollout DealNature Restoration Plans Come Due as Member States Race a DeadlineECB Rates Hold at 2.25 Percent as Frankfurt Waits on the DataEU Budget Talks Turn to Cohesion as Ireland Takes OverWildfire Response Stretches Europe’s Emergency Fleet ThinCan Europe’s Quantum Plan Match Its Big Ambitions?Armenia Edges West as Moscow’s Grip Slips AwayEurope Inherits the World’s Aid Bill It Cannot Fully PayAir Passenger Rights Get Their First Overhaul in Two DecadesErasmus Opens a 5 Billion Euro Round for Skills and MobilityCeuta Crisis Pushes the EU Toward Faster Migrant ReturnsBulky Parcels Face a Packaging Crackdown From August 12Can Europe Build Its Drone Wall Before 2030 Arrives?Indonesia’s Trade Deal With Europe Nears Its Final SignatureEurope Leans on Beijing to Keep Climate Talks Alive Before Antalya

Notified Bodies Face A June Switch-On For Cyber Product Checks

Renate Rapace
Legislative Analyst, Democratic Governance and Rule of Law

Espoo: The Cyber Resilience Act has spent most of its short life as a distant deadline, a 2027 obligation that manufacturers could file away for later. That changes in June. From 11 June 2026, the chapter governing the notification of conformity assessment bodies starts to apply, meaning the laboratories and certifiers that will eventually judge whether a connected product is secure enough to carry a CE mark can begin to be designated. It is an unglamorous milestone, but it is the plumbing on which the rest of the regulation depends.

The Act covers an unusually broad sweep of goods. Anything sold in the Union that contains digital elements falls within scope, from cheap consumer gadgets and smart home devices to business software and the kind of complex industrial control systems that run factories and power grids. For the first time, those products will have to meet a set of essential cybersecurity requirements over their whole supported lifetime rather than only at the moment of sale.

The next hard date is 11 September 2026, when the reporting duties in Article 14 begin. From that point manufacturers will have to flag actively exploited vulnerabilities and severe security incidents to the authorities. The clock is tight. An early warning is expected within twenty-four hours of a company becoming aware of a problem, a fuller notification within seventy-two hours, and a final report once a fix is available, no later than fourteen days after a corrective measure exists for an exploited vulnerability and within a month for a severe incident.

To avoid burying companies in parallel filings, the legislation funnels everything through a single reporting platform. A manufacturer notifies once, addressing the computer security incident response team in the country where it has its main establishment, and that information is made available at the same time to ENISA, the Union cybersecurity agency. The design is meant to spare firms the experience of reporting the same breach twenty-seven times while still giving national defenders the picture they need.

Industry has been pressing for clarity on what all of this means in practice, and the Commission has tried to answer by publishing draft guidance this year aimed at pinning down some of the more contested obligations. Questions about how to treat open-source components, how far a manufacturer’s responsibility stretches across a supply chain, and what counts as a product still in its support period have all generated anxiety among smaller developers in particular. Software companies that have never thought of themselves as makers of regulated hardware are discovering that the Act treats their code as a product like any other.

The bulk of the substantive requirements, including the security-by-design duties and the conformity assessment that products must pass, only bite from 11 December 2027. But the staggered structure means the next eighteen months are not a pause so much as a runway. The bodies designated this summer will need accreditation; the reporting channels switching on in September will generate the first real flow of vulnerability data into the system; and manufacturers that wait until 2027 to begin engineering work may find the certification queue uncomfortably long. The Act was sold as a way to stop insecure devices reaching European shelves. The machinery to enforce that promise starts moving in June.

Comments