Cologne – – September 15, 2026 -- Manufacturers of connected devices, industrial controls, routers and software products face their first binding reporting deadline under the EU Cyber Resilience Act (CRA) on September 11, 2026, when mandatory notification of actively exploited vulnerabilities and severe security incidents begins via a centralized EU reporting platform.