The European Commission states that Cyber Resilience Act reporting obligations apply from 11 September 2026 to products with digital elements made available i
Official source publication date: . AndroidSBC review date: 2026-10-26.
What does the European Commission say?
The European Commission’s 11 September 2026 publication explains the first operational reporting stage of the Cyber Resilience Act for products with digital elements placed on the EU market.
Key points from the official publication
- Reporting duties apply from 11 September 2026, while the CRA’s main obligations apply from 11 December 2027.
- For an actively exploited vulnerability, the official notice describes an early warning within 24 hours, a fuller notification within 72 hours, and a final report after a corrective or mitigating measure becomes available.
- For a severe incident affecting product security, the publication describes an early warning and notification process followed by a final report within the applicable official timetable.
- Notifications are intended to use the CRA Single Reporting Platform maintained by the European Union Agency for Cybersecurity.
- The framework concerns products with digital elements, including hardware and software, subject to its scope and exclusions; the responsible business must assess its product and role in the supply chain.
Practical actions for an Android product project
- Maintain a product and software inventory tied to model and firmware version.
- Define a monitored vulnerability-reporting channel and internal escalation owner.
- Keep enough technical evidence to assess exploitability, impact, affected versions and mitigation.
- Document update delivery, support period and responsibilities between board supplier, finished-device manufacturer, importer and operator.
What does this mean for Android board and embedded-device projects?
For an Android board incorporated into a connected finished product, define product identity, software bill of materials, vulnerability intake, incident escalation, update delivery, support period and responsibilities across the manufacturer, importer and integrator. Applicability must be assessed for the finished product and supply-chain role.
What should buyers and engineering teams verify?
- The exact board, PCB revision, SoC, BSP branch, kernel and Android build.
- The finished product’s intended use, wireless modules, enclosure and destination market.
- Security-update ownership, vulnerability contact, support period and incident process.
- Which controlled report, declaration or certificate applies to the exact configuration.
This article is an engineering summary, not legal or conformity-assessment advice. Requirements can change; confirm the current official text and obtain qualified local advice for the finished product.
Buyer FAQ
Common procurement and engineering questions related to this update are answered below. Project decisions must use the current official requirements and the exact product configuration.
Does buying an Android board make the finished device CRA compliant?
No. CRA obligations and conformity apply according to the finished product, its software, intended use and the economic operator’s role. Board documentation may support the assessment but cannot replace it.
What evidence should an EU buyer request from an Android board supplier?
Request hardware and software identification, supported BSP and kernel versions, software component information, vulnerability contact, update process, support period and relevant model-specific test or conformity documents.
Who should decide whether an Android product falls within the CRA?
The responsible manufacturer or economic operator should assess scope and obligations using the current official regulation and qualified EU compliance advice. A general website article is not a legal determination.
Official primary source
Primary source
European Commission
Read the original official publication
Source URL: https://commission.europa.eu/news-and-media/news/safer-and-more-secure-digital-products-2026-09-11_en
Editorial note: This is an original AndroidSBC engineering summary of the cited official publication. It is not legal advice and does not claim that every Android board or finished device is certified for the named market.
