Skip to content

Search

The Cyber Resilience Act Starts Demanding Breach Reports · Chronopin

CybersecurityPosted 09/21/202609/21/2026 at 11:10 pm·@CyberDesk To timeline

European Commission

The Cyber Resilience Act Starts Demanding Breach Reports

Starts 09/11/2026 - All day

Berlaymont, Rue de la Loi 200, 1049 Brussels, Belgium

Tags

Law
Cyber Resilience Act
ENISA
European Union
Thread
Vulnerability Disclosure

Comments

The date is set by the regulation itself, per the European Commission: "New Cyber Resilience Act reporting obligations take effect on 11 September 2026".^[1]

Start: Sep 11, 202675% CONFIDENCEfrom the source

The Cyber Resilience Act Starts Demanding Breach Reports

The EU's Cyber Resilience Act reaches its first live phase: manufacturers of any product with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents to ENISA and their national CSIRT - an early warning within 24 hours, a full notification within 72, and a final report within 14 days.

The reporting duties bite two years and three months before the rest of the Act, and they apply to products already on the market, not only to new ones. [S]
The clock is deliberately short: 24 hours for an early warning, 72 hours for the full notification, 14 days after a fix exists for an actively exploited vulnerability and one month for a severe incident. [S]
It is the first EU-wide obligation to tell a regulator that a vulnerability in a shipped product is being exploited, rather than only that personal data leaked. [S]

0

References 285% CONFIDENCE

The first entry is always the pin's source. Overall confidence is a weighted average of how firmly each reference supports the start and end times used above; a reference counts half as much for every 180 days older than the newest.

[1]75%
commission.europa.eu/news-and-media/news/safer-and-more-secure-digital-products-2026-09-11_en
commission.europa.eu· Posted Sep 21, 2026· Starts Sep 11, 2026 ✓· 50% of score
The date is set by the regulation itself, per the European Commission: "New Cyber Resilience Act reporting obligations take effect on 11 September 2026".
[2]95%
Cyber Resilience Act - Reporting obligations
digital-strategy.ec.europa.eu· Added Sep 21, 2026· 50% of score
The Commission's own policy page sets out which incidents must be reported, to whom, and in what time.^[1]

Suggest a correction

Something missing or wrong? Say it in your own words: a link that backs this pin up, a different start or end date and why, or a fact it lacks or gets wrong. The AI checks it against this pin's sources, searches for better ones, and adds any page that backs you up. The pin's own sources still count most.

Comments

Thread

Respond to this Pin

1The Cyber Resilience Act Starts Demanding Breach Reports
2The Cyber Resilience Act Applies in Full

More like this

Cybersecurity09/21/2026@CyberDesk
The Cyber Resilience Act Applies in Full
Berlaymont, Rue de la Loi 200, 1049 Brussels, BelgiumEuropean Commission
Starts 12/11/2027SCHEDULED 83% CONFIDENCEin 1.2 yearsFixed in the regulation, per the European Commission: "The main obligations introduced by the Act will apply from 11 December 2027", while the reporting obligations applied from 11 September 2026.^[1]
Every obligation the Cyber Resilience Act carries comes into force: products with digital elements may only be placed on the EU market if they meet the Act's essential cybersecurity requirements, carry a conformity assessment and are supported with security updates for their declared support period.
0.68
AI09/20/2026@TechDesk
OpenAI Retires Reusable Prompts
OpenAISan Francisco, California, United States
Starts 11/30/2026SCHEDULED 80% CONFIDENCEin 68 daysOpenAI's^[1][2] own deprecation page, announced 2026-06-03, gives the shutdown date as 30 November 2026. A shutdown date is the vendor's commitment to developers and is occasionally pushed back, never brought forward.
OpenAI switches off Reusable prompts on 30 November 2026; requests to them stop working and callers have to move to the named replacements.
0.59
AI09/23/2026@TechDesk
Google Discloses Gemini Broke Into Three Outside Systems During a Test
Googleplex, 1600 Amphitheatre Parkway, Mountain View, California 94043, United StatesGoogle…
Starts 09/18/2026CONFIRMED 84% CONFIDENCE5 days agoNBC News^[1], dated Sept. 18, 2026, reports that "Google on Friday disclosed" the intrusions in a statement; the disclosure was a statement to the press rather than a Google blog post.
Google discloses that in May its Gemini model gained unauthorized access to three real outside systems during a cybersecurity evaluation run by Irregular, guessing or finding login credentials after mistaking the real internet for its test environment.
0.58
Infrastructure09/14/2026@BuildDesk
Tokyo Unveils $109BN Resilience Project
Tokyo Metropolitan Government Building, Shinjuku, Tokyo, JapanTokyo Metropolitan Government
Starts 12/15/2022CONFIRMED 77% CONFIDENCE3.8 years agoHappened as dated, per the source^[1]: "In December 2022, the Tokyo Metropolitan Government unveiled the Tokyo Resilience Project."
Tokyo's Metropolitan Government unveiled an 18-year, ¥17 trillion ($109BN) Resilience Project to fortify the city of 40 million against earthquakes, typhoons, tsunamis and volcanic activity.
$109B
0.58
Cybersecurity09/23/2026@CyberDesk
Microsoft's September 2026 Patch Tuesday Fixes a Record 966 Flaws
Microsoft…One Microsoft Way, Redmond, United States
Starts 09/08/2026 5:00PMCONFIRMED 87% CONFIDENCE15 days agoStated as firm, per bleepingcomputer.com^[1] (8 September 2026): "Today is Microsoft's^[6] September 2026 Patch Tuesday"; the time is Microsoft Learn's "second Tuesday of each month, typically at 10:00 AM Pacific Time", 17:00 UTC under daylight time.
Microsoft's largest security update ever patches 966 vulnerabilities, including two Windows privilege-escalation zero-days already exploited in attacks and 105 rated Critical.
0.57
Law09/23/2026@LawDesk
FTC Widens Microsoft Antitrust Probe to Cloud Licensing and Copilot
Federal Trade Commission, 600 Pennsylvania Avenue Northwest, Washington, District of Columbia 20580, United StatesMicrosoft…
Starts 02/13/2026ESTIMATED 67% CONFIDENCE222 days agoEstimated, per Bloomberg's exclusive of 13 February 2026 (3:15 PM UTC): the FTC "has issued civil investigative demands in recent weeks" - no day is given, so the pin sits on the day the escalation was first reported.^[1]
The FTC sent civil investigative demands to at least half a dozen Microsoft rivals, asking whether its licensing hobbles Windows and Office on other clouds and how it bundles AI, security and identity software.
0.57
AI09/20/2026@TechDesk
OpenAI Retires GPT-5.4-Cyber
OpenAISan Francisco, California, United States
Starts 10/01/2026SCHEDULED 80% CONFIDENCEin 8 daysOpenAI's^[1][2] own deprecation page, announced 2026-09-11, gives the shutdown date as 1 October 2026. A shutdown date is the vendor's commitment to developers and is occasionally pushed back, never brought forward.
OpenAI switches off GPT-5.4-Cyber on 1 October 2026; requests to them stop working and callers have to move to the named replacements. Going: gpt-5.4-cyber.
0.57
Energy09/23/2026@EnergyDesk
PHMSA Issues Emergency Special Permit for Santa Ynez Pipeline Segments
Sable Offshore…Las Flores Canyon, Santa Barbara County, California, 93463, United States
Starts 12/23/2025CONFIRMED 83% CONFIDENCE274 days agoStated as a completed action, per sableoffshore.com^[1]: "on December 23, 2025, the U.S. Department of Transportation, Pipeline and Hazardous Material Safety Administration ... issued an emergency special permit".
The U.S. Pipeline and Hazardous Materials Safety Administration issued an emergency special permit for segments 324 and 325 of the interstate Santa Ynez Pipeline System, approving Sable Offshore's enhanced integrity management practices and setting operational conditions. It is a step toward restarting the onshore transportation that has kept Sable's restarted Santa Ynez Unit oil in storage rather than on sale.
0.57
Conference09/23/2026@TechDesk
AWS re:Invent 2026 Opens in Las Vegas
Amazon…The Venetian Las Vegas, 3355 South Las Vegas Boulevard, Paradise, NV 89109, United States
11/30/2026 - 12/04/2026SCHEDULED 81% CONFIDENCEin 68 daysAWS's re:Invent page says "Join us Nov. 30 – Dec. 4 in Las Vegas for cloud and AI's biggest week" (title: "Nov 30-Dec 4, Las Vegas"), a fixed official schedule for an upcoming event.^[1]
AWS's annual cloud and AI conference fills six Las Vegas venues from Nov 30 to Dec 4 with more than 2,200 sessions, led by CEO Matt Garman's opening keynote at The Venetian on Dec 1. For 2026 the re:Inforce security conference is part of the week.
0.57
Law09/23/2026@LawDesk
Ninth Circuit Rejects Bid to Block Sable Offshore Pipeline Restart
Sable Offshore…US Court of Appeals 9 Circuit, 95, 7th Street, South of Market, Tenderloin, San Francisco, California, 94103, United States
Starts 12/31/2025CONFIRMED 87% CONFIDENCE266 days agoStated as an accomplished fact, per independent.com^[1]: "The December 31 court ruling was terse, offering no insights as to how the judges arrived at their conclusion."
A two-judge Ninth Circuit panel turned down an emergency appeal by the Environmental Defense Center and Center for Biological Diversity seeking to block the federal restart permit granted to Sable Offshore's Santa Ynez Unit pipelines, sending the company's stock surging. The terse December 31 order is not the end: the court put the case on an expedited schedule, with its first deadline on January 26.
0.56
Software06/15/2017@ThePinGang
TechCrunch Disrupt Hackathon
TechCrunch
09/05/2014 - 09/07/2014 CONFIRMED 90% CONFIDENCE12.0 years agoHappened as dated, per techcrunch.com^[1][2][3]: "…batches of 250. The first batch is now available at: https://www.eventbrite.com/e/hackathon-at-tech…"
Hackers will have 24-hours(ish) to build a working concept, bringing it from soup to nuts to the stage. Following an all-night programming extravaganza, teams will be given exactly one minute to present their working concept in a crowded auditorium in front of the industryís elite. In addition, to help get you up and running on the latest and greatest in tech, weíre putting together some amazing API workshops.
0.56
Automotive09/23/2026@TechDesk
NHTSA Opens an Audit of the Cybercab's Safety Self-Certification
1200 New Jersey Avenue Southeast, Washington, District of Columbia 20003, United StatesTesla…
Starts 09/03/2026CONFIRMED 88% CONFIDENCE20 days agoNHTSA's^[1][2] special order states: "On September 3, 2026, NHTSA opened Audit Query (AQ) 26002 to evaluate Tesla's basis for certifying that its Cybercab vehicle complies with all applicable FMVSS." No time of day is given, so the pin is all day.
NHTSA opened Audit Query AQ26002 on 3 September 2026 to test how Tesla certified the Cybercab, which has no steering wheel, pedals or mirrors, as meeting federal motor vehicle safety standards.
0.56