From 11 September 2026, manufacturers of connected products already on the market - not only new ones - must report actively exploited vulnerabilities and severe incidents to ENISA and national computer security incident response teams within 24 hours. The bulk of essential cybersecurity requirements, conformity assessment and CE marking obligations apply from 11 December 2027, in parallel with the Machinery Regulation's own 'protection against corruption' requirements, which the two texts are designed to be read together with, particularly for robotics and autonomous systems that rely on networked control.

#CyberResilienceAct #Robotics #ConnectedMachinery #Cybersecurity