Since 11 September 2026, every manufacturer of a connected device sold in the EU must report an actively exploited flaw within 24 hours. The rest of the CRA arrives in December 2027, and it starts with the prototype.