CRA

EU Cyber Resilience Act · European Commission / European Parliament · Official site

EU regulation requiring cybersecurity-by-design for products with digital elements sold in the EU, entered into force December 2024. Vulnerability reporting obligations start September 2026; main product security obligations apply December 2027.

Timeline

Vulnerability reporting obligations under CRA come into force in the EU New document eu

As of 11 September 2026, Article 14 of the Cyber Resilience Act (EU Regulation 2024/2847) becomes applicable in the EU, establishing horizontal cybersecurity requirements for products with digital el…

Source 2026-09-11 Effective 2026-09-11

EU proposes Public Procurement Act consolidating directives and amending regulations Draft consultation eu

The European Commission proposes a new Public Procurement Act that consolidates the three 2014 procurement directives (2014/23/EU, 2014/24/EU, and 2014/25/EU) into a single regulation and amends mult…

Source 2026-09-09

CIS and SAFECode release Secure by Design v1.1 with expanded AI guidance New version global

CIS and SAFECode have published version 1.1 of Secure by Design: A Guide to Assessing Software Security Practices, updating the original framework to address evolving software development practices a…

Source 2026-07-13 Action required

EU adopts Regulation (EU) 2025/327 on European Health Data Space New document eu

Regulation (EU) 2025/327 of the European Parliament and of the Council was adopted on 11 February 2025 to establish the European Health Data Space framework, with entry into force on 25 March 2025. T…

Source 2025-02-11 Effective 2025-03-25

Monitoring

Watched by 3 official sources. Watching since 7 September 2026. Last checked 11 minutes ago.