Your suppliers now have 24 hours to tell you. Do you know what you are running? writes Dan Jones, Senior Security Advisor, EMEA at the cyber platform Tanium.
The EU’s Cyber Resilience Act (CRA) reached its first real deadline on 11 September 2026 and passed quietly. The headlines were busy with Australia’s prime minister saying an AI agent had got into a government health portal. For anyone who installs, specifies or runs connected security kit, the CRA is the more important story.
Since that date, manufacturers have had to report any actively exploited vulnerability or severe incident affecting their products. In CRA terms, a manufacturer is anyone who makes a digital product, or has one made, and sells it under their own name. Software houses count as much as hardware makers, and so does an installer or integrator who rebrands someone else’s kit. The Commission is blunt about the clock: “They must submit an early warning within 24 hours, followed by a full notification within 72 hours.” Notifications go through the Single Reporting Platform that ENISA built and runs. The remaining obligations apply from 11 December 2027. The penalty is up to 15 million euros or 2.5 per cent of worldwide annual turnover, whichever is higher.
The scope is wide. Law firm Pinsent Masons put it plainly: “in principle, every product sold in the EU that contains digital elements must comply with the CRA.” That catches UK firms that export, and it reaches well beyond security kit into the everyday endpoint estate. The Act’s “important” product classes name operating systems, browsers, password managers, VPN products and anti-malware software, along with security cameras, alarm systems and smart door locks. All of them face stricter conformity checks than most. Euralarm, the European trade body for fire and security, has pressed for clearer definitions of what that covers. Whether your commercial CCTV and access control sit inside it is a question to put to your supplier in writing.
At home, the UK’s product security regime for consumer connectable products has applied since 29 April 2024, and the Cyber Security and Resilience Bill is still before the House of Lords.
The danger is a comfortable misreading. A board sees “suppliers must report within 24 hours” and quietly files security under somebody else’s job. It is nobody else’s. Think of a recall notice for a flaw in an operating system or a VPN client. The manufacturer can send it inside a day, but it only protects you if you know which laptops and servers run it and who is responsible for them.
Then consider who does the reporting. In many suppliers, the engineers drafting that 24-hour notice are the same people trying to find the flaw, contain it and ship a fix. Every hour on the paperwork is an hour off the patch, so the notice may reach you before the fix does. Whatever stops an attacker in the meantime, you will probably have to build yourself. Isolate the exposed endpoints and watch them closely until the permanent fix arrives.
Cybersecurity is a people problem wearing a technology costume, and the CRA does nothing about the people. When a supplier’s warning lands, someone in your organisation has to say, inside the hour, which endpoints, from laptops and servers to door readers and cameras, run the affected product, whether they are patched and who owns the fix. Put that question to your team this week. If the answer takes days, the warning was wasted.
Continuous visibility of every endpoint closes that gap. Autonomous endpoint management goes further: AI and automation that find the exposure and fix it across the estate, then check that the fix landed, at the speed the warnings now arrive.
Ask the upstream question as well, because the cheapest vulnerability to report is the one that never shipped. How do you find flaws before release, and will you show me? Tanium has said it is applying frontier AI models to its own production code through Anthropic’s Project Glasswing and will publish what it learns. Hold every supplier to that standard, us included.
Then ask how long they will ship security updates. The Act obliges manufacturers to deal with vulnerabilities throughout a support period of at least five years, or the product’s expected life if that is shorter. There is an end date somewhere. Find it, diarise it, and decide now whether you will replace the product or fence it off. An unsupported operating system on a forgotten server keeps working right up to the day it lets someone in.
You will not get certainty before the next deadline, or the one after. Decide anyway. Give a named person the product list and a date. An imperfect decision with an owner beats a perfect plan nobody signs. Manufacturers have their deadline. Yours arrives the next time someone exploits a flaw in something you own.
