https://OpenChain-Project.github.io/OpenChain-KWG/en/tags/cybersecurity/Recent content in Cybersecurity on OpenChain KWGHugoenMon, 10 Aug 2026 11:20:08 +0900https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/Mon, 18 May 2026 00:00:00 +0000https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/<div class="alert alert-info" role="alert"> <p>This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.</p> </div> <blockquote> <p><strong>Summary</strong></p> <p>The EU Cyber Resilience Act (Cyber Resilience Act, CRA — Regulation (EU) 2024/2847) is the EU&rsquo;s first comprehensive product security regulation, imposing horizontal cybersecurity obligations on every &ldquo;product with digital elements&rdquo; (PDE) placed on the EU market. The regulation entered into force on December 10, 2024, and applies in phases. From September 11, 2026, the Article 14 reporting obligations take effect, requiring manufacturers, importers, and distributors to notify ENISA (the European Union Agency for Cybersecurity) and Member State CSIRTs of actively exploited vulnerabilities and severe incidents within a staged 24-hour, 72-hour, and 14-day window. Companies that have not stood up a reporting workflow by this date face fines of up to €15 million or 2.5% of worldwide annual turnover, and Korean companies that place products on the EU market are subject to the obligation immediately. <a id="a1-ref-1"></a><a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/#a1">A1</a>, <a id="b1-ref-1"></a><a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/#b1">B1</a>, <a id="e1-ref-1"></a><a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/#e1">E1</a></p>