European Council Adopts Cyber Resilience Act

The EU Council adopted the Cyber Resilience Act (CRA), introducing cybersecurity obligations for manufacturers of software and connected products sold in the EU—including coordinated vulnerability disclosure policies, remediation and security updates, reporting of actively exploited vulnerabilities to CSIRTs and ENISA, and requirements for Software Bill of Materials (SBOM). The regulation will enter into force shortly after publication with most provisions applying three years later and some vulnerability-reporting requirements within 21 months; HackerOne supported improvements for researcher protections but remains concerned about mandatory disclosure of actively exploited vulnerabilities.