The EU Cyber Resilience Act Reporting Clock Has Started: What It Means for Control System Builders

On 11 September 2026, the reporting obligations of the EU Cyber Resilience Act (CRA) began to apply. Manufacturers of products with digital elements must now notify ENISA of actively exploited vulnerabilities within 24 hours. The full requirements follow on 11 December 2027.

The CRA applies to manufacturers, while NIS2 applies to operators, so a plant owner and its equipment suppliers are affected in different ways. A manufacturer of industrial controllers could fall under both. Penalties under the CRA can reach EUR 15 million or 2.5% of annual turnover, and there is considerable overlap in what the two regimes ask for: risk assessment, incident response, access control and supply chain management.

In practice this puts software bills of materials (SBOMs), vulnerability handling processes and secure update mechanisms on the critical path. Legacy PLCs and DCS platforms with 15 to 25 year lifetimes were not designed for modern authentication, encryption or monitoring, and sources disagree on exactly how industrial control products are classified, so the CRA annexes and implementing acts should be checked directly.