EU Cyber Resilience Act starts September 11: retailers face 24-hour clock
The EU Cyber Resilience Act’s reporting duties begin on September 11, 2026, forcing a 24-hour early warning on actively exploited vulnerabilities in connected products. Retailers selling own-brand smart devices are treated as manufacturers, putting the clock on their side of the contract.