CLAIM-2026-10-15-11
Regulation (EU) 2024/2847, the Cyber Resilience Act, applies its main obligations including the essential requirements on limiting attack surfaces from 11 December 2027, while its Article 14 reporting duty for actively exploited vulnerabilities has applied since 11 September 2026.
Why it matters
The instrument that would speak to attack surface, and the date it starts to.
Sources
- europeancom2026timeline