News · written 2 November 2026. This is a summary for readers, not legal advice — check the sources at the end for anything you rely on.

The first part of the European Union's Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is now in force for real. Since 11 September 2026, makers of software and connected devices sold in the EU have had to report security holes that attackers are already using. If you publish apps, tools or games — including on JM Tech Power — here is the short version.

What started in September

A manufacturer that learns an actively exploited vulnerability in its product — a flaw attackers are using in real attacks, not just a bug — now has to tell the authorities on a fixed clock:

• Within 24 hours: an early warning.
• Within 72 hours: a fuller notification with a first assessment and what has been done.
• Within 14 days after a fix is available: a final report.

Reports go to the national computer security response team (CSIRT) through a single reporting platform run by ENISA, the EU cybersecurity agency. Severe security incidents follow a similar 24-hour / 72-hour rhythm, with a final report within a month. Affected users must be told too. The duty covers products already on sale, not only new ones.

The bigger date: December 2027

Reporting is only the first step. From 11 December 2027 the main rules apply: products with digital elements must be built and maintained to the Act's security requirements — secure by default, security updates, vulnerability handling — before they can be sold in the EU. The Act entered into force on 10 December 2024, so the industry has had three years to prepare.

What about hobby and open-source projects?

This was the most argued-over part of the law, and the final text is much narrower than early drafts:

• Only software supplied in a commercial activity is in scope. According to the European Commission, free and open-source software that is not monetised is not treated as a commercial activity, and people who simply contribute code to a project they are not responsible for are not covered.
• Open-source "stewards" — foundations and similar organisations that support open-source software meant for commercial use — get a lighter regime: a documented security policy, cooperation with authorities, and reporting of exploited vulnerabilities. Those steward duties start on 11 December 2027, and stewards cannot be fined under the Act.
• Selling it changes things. If a company places open-source software on the market as part of its business, it is treated as a manufacturer with the full set of obligations.

Why it matters for small developers

Even if your own project is a free hobby release, the CRA is already shaping the tools you depend on: larger vendors are publishing security policies, shipping software bills of materials (SBOMs) and asking their suppliers how they handle vulnerabilities. Three habits are worth picking up now, whatever your size:

• Say how to report a problem. A security contact or a security.txt file tells people where to send a vulnerability.
• Keep a list of what you ship. Knowing which libraries and versions are inside your release makes it far quicker to check whether a new flaw affects you.
• Ship fixes as proper releases. Versioned releases with notes make it clear to users which build is safe.

If you sell software in the EU, or plan to, read the official guidance below and get proper advice for your case.

Sources

• European Commission — Cyber Resilience Act (key dates: in force 10 December 2024, reporting from 11 September 2026, main obligations from 11 December 2027).
• European Commission — The Cyber Resilience Act and open source (scope for free and open-source software, stewards, no fines for stewards).
• Goodwin — Preparing for the EU Cyber Resilience Act, 11 September 2026 (reporting deadlines and steward dates).

More news and guides at https://jmtechpower.com/articles.