EU Cyber Resilience Act: Vulnerability Reporting Obligations
The CRA’s vulnerability reporting obligations start on 11 September 2026 and apply to products already on the market, including ones sold years ago. What Article 14 requires, which duties run to whom, how reporting works through the ENISA Single Reporting Platform, and where the Espressif platform layer fits.