# EU Cyber Resilience Act vulnerability reporting obligations take effect

_Published Thursday, September 10, 2026 at 10:55 PM EDT · Policy, Security · Latest · Tier 2 — Notable_

The EU Cyber Resilience Act's vulnerability reporting obligations to ENISA arrive on September 11, according to an OpenSSF tech talk recap.

The full regulation lands in December 2027. OpenSSF cited a 2026 readiness report finding 66% of respondents still unfamiliar with the regulation, with only 41% of manufacturers expecting full compliance by the deadline. Under the CRA, maintainers who do not monetize projects carry no obligations, while manufacturers consuming open source bear due diligence, upstream contribution and incident reporting duties.

OpenSSF published steward and maintainer checklists, and its ORBIT Launchpad group released manufacturer baseline catalogs.

## Sources

- [Open Source Security Foundation](https://openssf.org/blog/2026/09/10/tech-talk-recap-a-practitioners-guide-to-cra-readiness/)
- [Open Source Security Foundation](https://openssf.org/blog/2026/09/11/a-community-guide-to-the-eu-cra-september-11-deadline-for-manufacturers/)

---
Canonical: https://techandbusiness.org/newswire/zLxrDPuJWcNiwX1iMwAtR2
Published: 2026-09-11T02:55:38.098Z
Story chronology: 2026-09-11T00:00:00.000Z
Retrieved: 2026-10-26T09:09:58.302Z
Publisher: Tech & Business (techandbusiness.org)