Three dates that land inside product roadmaps rather than inside legal departments. Two of them are four weeks away.
From 11 September 2026
CRA reporting duties start — 24 hours, not 24 days
Under the EU Cyber Resilience Act, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the Single Reporting Platform: early warning within 24 hours, full notification within 72 hours, final report within 14 days of a remedy being available.
This is not a security topic, it is a product-organisation topic. Twenty-four hours means a named on-call rota, a pre-agreed decision right to declare, and a maintained software bill of materials across the entire installed base — including the devices you shipped five years ago and no longer have a team for. Anyone starting in September will file their first report from a spreadsheet.
Data Act: access by design becomes a hardware requirement
Connected products and related services placed on the EU market after that date must be designed so that the data they generate is, by default, easily, securely and directly accessible to the user — in a structured, machine-readable format, free of charge where technically feasible.
The part most roadmaps skip: the access has to be designed in, not retrofitted, and the cut-off is placing on the market — which means it hits products currently in series development, with tooling already ordered. Strategically it is bigger than the compliance work: if your aftermarket business has been protected by owning the service data, that moat is being drained by law. The advantage moves from holding the data to interpreting it better than anyone else can.
The AI Omnibus moves the high-risk obligations from 2 August 2026 to 2 December 2027 for standalone systems, and to 2 August 2028 for AI embedded in regulated products, while removing some overlapping requirements for embedded AI.
Two extra years sounds like relief. In practice this is the second postponement, and planning against a moving date is more expensive than planning against a fixed one — teams stop, restart, and lose the people who held the context. My recommendation is not to defer the work but to reclassify it: treat the technical documentation, data governance and logging requirements as engineering hygiene you want regardless, and the deadline stops mattering.
