EU CRA vulnerability reporting rules take effect Sept 11; vendors face 24-hour disclosure

The EU Cyber Resilience Act's vulnerability reporting requirements become binding on September 11, mandating software vendors to report actively exploited flaws within 24 hours. ActiveState highlights that precise shipment records and vulnerability discovery timelines are essential for compliance. This marks a regulatory shift that could impose significant operational burdens on software vendors operating in the EU.