CYBER RESILIENCE ACT: 11 SEPTEMBER 2026 – KEY STARTING POINT FOR REPORTING OBLIGATIONS

Summary from the TLDR Founders newsletter

Selling software into Europe now comes with a breach-reporting clock, and it starts this Friday. From September 11, any company selling hardware or software that connects to a network in the EU has to report an actively exploited vulnerability under the Cyber Resilience Act. The first warning is due within 24 hours of finding out, a fuller notification within 72 hours, and a final report within 14 days of a fix. Severe incidents follow the same 24- and 72-hour steps. There is no revenue threshold, so a five-person startup with one EU customer is inside the rule.