EU Cyber Resilience Act: What Changed in July 2026 (Status Update, 4 August)
July 2026 was the busiest month the EU Cyber Resilience Act has had since it entered into force. Three things changed the practical picture: the Commission published its first official application guidance, ENISA published two free tools aimed squarely at smaller manufacturers, and ENISA's Single Reporting Platform documentation was updated ahead of go-live.
Nothing in the law changed. The deadlines are unmoved. But the amount of official material you can now rely on went up sharply - and the nearest hard date, 11 September 2026, is now about five weeks away.
This post covers every development in date order, what did not change, one thing on the horizon, and a five-week checklist.
This post is general guidance on the Cyber Resilience Act, not legal advice. Confirm specifics against Regulation (EU) 2024/2847.
What shipped in July 2026
13 July - ENISA SME Cyber Resilience Maturity Assessment Model
On 13 July 2026, ENISA published the SME Cyber Resilience Maturity Assessment Model, a free, structured tool that lets micro, small and medium-sized enterprises measure how ready they are for the Cyber Resilience Act.
The model provides a structured approach for micro, small and medium-sized enterprises to evaluate and strengthen their overall cyber resilience, while taking into account the requirements of the CRA. It is primarily intended for organisations that manufacture and place products with digital elements on the market, as these are directly subject to CRA requirements.
The tool scores an organisation across five domains: governance and documentation, risk management and security by design and by default, vulnerability management, product lifecycle management, and cybersecurity skills. Each criterion is rated on a maturity scale from 1 to 5, and the results roll up into an overall profile of basic, intermediate or advanced.
To support practical implementation, the maturity model includes a downloadable Excel tool that guides users through the process, automatically calculates maturity scores and helps SMEs to track progress across repeated self-checks.
One important caveat: ENISA is explicit on this point - reaching a higher maturity level does not replace compliance with the CRA. The model is a diagnostic, not a conformity assessment. A high score does not mean your product is compliant; it means you have a clearer picture of where the gaps are.
What to do: Run the Excel tool now, before you start building your technical file. It gives you a defensible starting baseline and a self-assessment you did not have to invent from scratch. Use the output to prioritise the biggest gaps before 11 September.
27 July - European Commission publishes first official CRA application guidance (C(2026) 5252)
On 27 July 2026, the European Commission published practical guidance on the application of the Cyber Resilience Act, issued as Communication C(2026) 5252 with a detailed annex.
The Commission has adopted C(2026) 5252, the guidance on applying the Cyber Resilience Act that Article 26(1) requires it to publish. Across 84 pages it works through scope, free and open-source software, substantial modification, support periods, classification, risk assessment, remote data processing and reporting, illustrated by 67 examples. Section 9.1 covers the reporting obligations of manufacturers and open-source software stewards in detail.
The guidance explicitly addresses microenterprises and SMEs, with 67 practical examples and flowcharts aimed at organisations without in-house counsel.
Binding or not? Be precise here. Guidance is not binding and does not change the law: an authoritative interpretation of the CRA can only come from the Court of Justice of the EU. But market surveillance authorities and notified bodies look to it for a consistent, harmonised reading, so it is the natural companion to the Regulation.
Today's guidance - though non-binding - gives companies the clarity they need to prepare now, confidently and efficiently. The Commission has also indicated it may issue further guidance under Article 26 as additional interpretive questions arise.
What to do: Read the sections relevant to your product category. If scope or substantial modification questions have been stalling your internal CRA project, this document now gives you an official answer to point to. Download it from the European Commission's CRA page.
C(2026) 5252 is the Commission's interpretation of the CRA — highly persuasive and what authorities will work from. It is not legally binding in the way the regulation text is. Only the Court of Justice of the EU can give an authoritative interpretation. The regulation governs; the guidance explains.
30 July - ENISA Secure by Design and Default Playbook
On 30 July 2026, the European Union Agency for Cybersecurity (ENISA) published its Secure by Design and Default Playbook, a guide for small and medium-sized manufacturers developing products with digital elements. The guidance is designed to help implement the security requirements of the Cyber Resilience Act by embedding security in the product life cycle.
The document translates security principles from ENISA guidance, NIST and OWASP into practices that can be incorporated into development processes. It defines 22 principles: 14 under Secure by Design and 8 under Secure by Default.
Appendix C of the Playbook provides a direct mapping of the 22 security principles to the requirements in Annex I of the Cyber Resilience Act. That mapping is the most concrete official bridge yet between "security by design" as a legal phrase in Annex I, Part I and things an engineering team can actually put in a backlog.
ENISA's approach is based on the consistent integration of security early in the development process - a concept known as "shift left." Security requirements begin not during testing or in production, but at the stages of requirements definition, architectural design, and technology selection.
ENISA also publishes the playbooks in a navigable GitHub repository at github.com/enisaeu/enisa-sbd-playbook, where the 22 individual playbooks can be browsed and adopted progressively. Progressive adoption does not suggest delaying applicable requirements or controls, particularly those arising from legal obligations, including under the CRA. This guidance is without prejudice to such obligations, which take precedence.
Download the full playbook from ENISA's publications page. For how these principles map to the Annex I essential requirements in practice, see our post on CRA security by design and Annex I.
What to do: Share the playbook with your engineering lead. The Appendix C mapping is the fastest way to connect a legal requirement to a sprint ticket.
31 July - ENISA Single Reporting Platform documentation updated
ENISA published a factsheet and two guidance documents in July 2026. Both guides were last updated 31 July 2026.
The status of the platform itself has not changed: the platform is scheduled to be operational by 11 September 2026, coinciding with the date when the mandatory reporting obligations for manufacturers officially enter into application under Article 14 of the Cyber Resilience Act. A testing period is expected to take place before this date.
As of 16 July 2026, the platform is not yet live and remains in a pre-operational testing phase. Initial rollout will not include APIs - reporting will be via manual portal entry, not system-to-system.
Manufacturers report only once through the CRA Single Reporting Platform. The notification is addressed to the Computer Security Incident Response Team (CSIRT) where they have their main establishment and, unless particularly exceptional circumstances apply, the information is made available simultaneously to ENISA.
What to do: You cannot register or rehearse on the live platform yet. Build the internal workflow now - detection, severity call, sign-off, drafting - and treat the platform as the last mile. Full guide: ENISA Single Reporting Platform: CRA Guide.
What did NOT change
The three canonical CRA dates are unmoved:
| Date | What it means | Who it affects |
|---|---|---|
| 10 December 2024 | CRA entered into force | All |
| 11 June 2026 | Chapter IV (conformity assessment bodies) applies | Notified bodies, national authorities |
| 11 September 2026 | Reporting obligations begin — actively exploited vulnerabilities and severe incidents must be notified via the SRP | All manufacturers with products on the EU market |
| 11 December 2027 | Full application — all essential requirements, SBOM, CE marking, EU Declaration of Conformity enforceable | Manufacturers, importers, distributors |
Two other things that have not changed:
No CRA harmonised standard is yet cited in the Official Journal. As of mid-2026, no CRA harmonised standard has been approved or had its reference published in the Official Journal. The presumption of conformity under Article 27 is therefore not yet available for any product category. Standards are advancing - the horizontal EN 40000 drafts and ETSI's EN 304 6xx series are furthest along - but drafts are not citations. See our tracker: CRA harmonised standards and presumption of conformity.
The Annex III/IV delegated acts are still pending. The implementing regulation describing the core functionality of important and critical product categories was adopted in November 2025, but the delegated acts that will determine conformity assessment routes for Annex IV products are not yet final.
One thing on the horizon - but not yet law
The Commission's Digital Omnibus package, published in November 2025 and subject to a provisional trilogue agreement in May 2026, proposes a centralised Single Entry Point for cybersecurity incident reporting. ENISA would be responsible for defining and operating a single entry-point platform for cyber incident reporting. Through this system, rather than filling separate notifications under GDPR, NIS2, DORA and other regulatory frameworks, organisations would respond to different legal requirements in a single platform.
Under the proposal, severe incident reports under the CRA could also satisfy NIS2 reporting where they contain the required information.
Three things to be clear about:
- This is a proposal, not law. The Digital Omnibus has not been formally adopted. Until it is, nothing changes.
- It does not move your 11 September 2026 obligation by a single day. The CRA's reporting deadline is fixed in Regulation (EU) 2024/2847. A proposal to amend NIS2 does not touch it.
- Do not wait for it. It will be at least 18 months from when the Digital Omnibus is approved before the Single Entry Point takes effect, and that may be extended by a further 6 months. Build your process for the SRP now.
Your five-week checklist
11 September 2026 is five weeks away as of 4 August 2026. Here is what to have in place before that date:
Someone must be authorised to make the call: is this an actively exploited vulnerability or a severe incident? That person needs to be reachable at any hour. Document the name, their backup, and the escalation path.
Draft a one-page internal definition of what counts as an actively exploited vulnerability and what counts as a severe incident for your product. This is the decision your team will make under time pressure. Write it now, not during an incident. See our guide: CRA actively exploited vulnerability reporting trigger.
Run a single tabletop: a hypothetical vulnerability is reported at 9 pm on a Friday. Who does what, and by when? The 24-hour early warning, 72-hour notification, and 14-day final report deadlines apply in full from 11 September regardless of when ENISA publishes final onboarding materials.
Article 14 requires a publicly accessible channel for vulnerability disclosure. If you do not have one, set it up now. See our guide: CRA coordinated vulnerability disclosure policy.
When a vulnerability is disclosed, the first question is whether your product is affected. An SBOM — even a partial one — is the fastest way to answer that. See: Do you need an SBOM for the CRA?.
Where to go next
- Key deadlines at a glance - the canonical CRA timeline in one place
- CRA compliance checklist - the full sequenced readiness roadmap
A plain-English summary of every CRA development, delivered the week it drops. No noise — just what changed, why it matters, and what to do about it.
Related reading
CRA Harmonised Standards and the Presumption of Conformity: Where Things Stand in 2026
No CRA harmonised standard is cited in the Official Journal yet. Here's what the presumption of conformity means, where M/606's 41 standards stand, how EN 18031 fits, and what to do right now.
Is My Product in Scope of the CRA? A Plain-English Guide to "Products with Digital Elements"
The Commission's July 2026 guidance makes CRA scope clearer than ever. Here's how to decide whether your product is a "product with digital elements" - and therefore in scope.
Does This Trigger a CRA Report? How to Identify an Actively Exploited Vulnerability and a Severe Incident Under Article 14
With the 11 September 2026 CRA reporting deadline under 45 days away, here's exactly what triggers a mandatory Article 14 report - and what doesn't.