IoT in Transition: Device Security Has Officially Become a Governance Problem
IoT Now, Wednesday, September 16th, 2026
EU Cyber Resilience Act reporting obligations take effect, making device security a governance challenge.
The EU Cyber Resilience Act's reporting requirements became effective September 11, 2026, requiring manufacturers to report actively exploited vulnerabilities within 24 hours and file full notifications within 72 hours.
Full compliance is required by December 11, 2027, with penalties up to 15 million euros or 2.5% of global turnover.
The regulation creates accountability gaps between manufacturers and operators, requiring organizations to clarify responsibility across complex supply chains while ensuring devices remain secure throughout their lifecycle.