Insights

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024, with direct application across the EU. Full application begins 11 December 2027, but one of its most operationally demanding provisions takes effect in just under 100 days, on 11 September 2026: the mandatory vulnerability and incident reporting under Article 14 CRA.

On January 11, 2024, the Data Act entered into force. This marks a significant milestone in the evolving landscape of digital regulation. The Data Act is part of the broader European data strategy and plays a significant role in advancing the EU’s digital transformation objectives outlined in the Digital Decade Policy Program 2030.