The Cyber Resilience Act reporting clock started on 11 September 2026. What NIS2, DORA and the CRA now require of boards
Vulnerability and incident reporting duties for products with digital elements are live, NIS2 registration is lagging in major Member States and DORA supervision is maturing. A practical map of the obligations that now overlap.
Three EU regimes now shape how organisations must prevent, detect and report cyber incidents, and in September 2026 the newest of them began to bite. This article sets out where each regime stands and what boards and security leaders should be doing this quarter.
Cyber Resilience Act: reporting obligations are live
The Cyber Resilience Act entered into force on 10 December 2024. Its reporting obligations apply from 11 September 2026, and its main obligations apply from 11 December 2027.
From 11 September 2026, manufacturers of products with digital elements placed on the EU market must report actively exploited vulnerabilities and severe incidents affecting the security of their products through the single reporting platform coordinated by ENISA, with an early warning within 24 hours and follow-up notifications within the subsequent deadlines set by the Act. The practical consequence is that any company that makes hardware or software sold in the EU, including industrial equipment, connected devices and many business applications, must now have a vulnerability handling process that can detect exploitation, assess severity and notify quickly.
For many manufacturers the hardest part is not the notification form but the upstream capability: knowing which components are in the product, receiving vulnerability reports, and distinguishing exploitation from theory. A software bill of materials, a coordinated disclosure channel and a severity assessment process are the minimum.
NIS2: transposition and registration are uneven
The NIS2 Directive's transposition deadline passed in 2024 and several Member States missed it. Germany is a prominent example: its implementing law was published on 5 December 2025, with a registration deadline of 6 March 2026, and reporting indicates that only around one third of entities subject to registration had done so. The Critical Entities Resilience Directive followed a similar path in Germany, with implementation on 17 March 2026 and first registration obligations from 17 July 2026.
For entities in scope, registration is only the first step. NIS2 requires risk management measures, supply-chain security, incident reporting within 24 and 72 hours, and management accountability, including personal liability for the management bodies that approve and oversee those measures. Supervisors in several Member States have begun to request evidence.
DORA: supervision is maturing
The Digital Operational Resilience Act has applied to financial entities since 17 January 2025. Through 2026, supervisory expectations continue to develop, particularly around ICT third-party risk registers, major incident classification and reporting, and the planning of threat-led penetration testing. Financial entities that treated January 2025 as a finish line are finding that supervisors treat it as a starting point.
What is coming next
The European Commission announced the Cybersecurity Act 2.0 in January 2026, with finalisation expected in early 2027. It is expected to adjust NIS2, update the certification framework and revise ENISA's role. The Machinery Regulation applies from 20 January 2027 as a directly applicable regulation, adding cybersecurity requirements to machinery safety.
A quarter's work for boards and security leaders
- Map applicability. Which entities are in scope of NIS2 as essential or important entities, which products fall under the CRA, which financial entities are under DORA, and in which Member States.
- Register where required and keep the registration current.
- Build one incident reporting playbook that satisfies NIS2, DORA, CRA and GDPR deadlines from a single set of facts. Multiple reports from inconsistent facts are a supervisory red flag.
- Evidence management accountability. Board minutes, training records, risk acceptance decisions and resourcing approvals are what supervisors ask for first.
- Prepare supply-chain evidence. Contracts, due diligence and monitoring of critical ICT providers are required under both NIS2 and DORA.
- For manufacturers, operationalise vulnerability handling now. The 24-hour early warning cannot be met by a process that starts when the lawyer is called.
Sources
- Reed Smith: EU cybersecurity regulatory update for 2026 and beyond
- Compliance Hub: DORA enforcement arrives and NIS2 hits its October deadline
