EU Cyber Law Nears: Most Firms Know the Rules, Few Are Ready
Published on 07/11/2026 at 22:05 | Redaktion boerse-global.de
Only 13 percent of companies have a deep understanding of the technical documentation required under Europe’s new Cyber Resilience Act (CRA), despite two-thirds claiming to be familiar with the regulation. That gap threatens to become a compliance crisis when mandatory reporting kicks in on September 11, 2026.
For manufacturers of digital products, the obligation kicks in that day. They must disclose vulnerabilities and incidents within strict timelines or face fines of up to 15 million euros, or 2.5 percent of global annual turnover, whichever is higher. The clock starts ticking fast: a preliminary warning must go out within 24 hours of a problem being discovered. A full report follows at the 72-hour mark. After a fix is deployed, companies have 14 days to submit a final account. All reports go through a central platform run by the EU Agency for Cybersecurity (ENISA).
The regulation’s goal is to embed security across a product’s entire lifecycle, from design to the end of support. Yet many businesses are struggling with basics. Common deficiencies include poor product inventories, weak monitoring of the software development cycle, and unclear internal responsibilities for security tasks.
Siemens Launches CRA-Ready Hardware
On July 10, 2026, Siemens unveiled a new generation of hardware modules for its Sinumerik One control systems. The components are specifically built to meet CRA requirements and also support AI applications. The move comes as the global embedded-computing market is projected to hit roughly €68 billion in 2026.
A survey cited in the article found that 75 percent of manufacturing companies now see cybersecurity as the biggest obstacle to implementing Industry 4.0 concepts. Meanwhile, 87 percent of German firms have recently been hit by cyberattacks. Total damage across the country is estimated at nearly €290 billion, and attacks on industrial systems have doubled since 2022.
EU Ties AI Security to Broader Cyber Rules
On the same day Siemens made its announcement, the European Commission published an action plan that links the AI Act more closely with existing directives such as NIS2 and the CRA. Under the plan, AI models must pass cybersecurity checks before entering the market. ENISA is setting up test platforms to handle those assessments.
For the fourth quarter of 2026, the EU also plans to launch a Europe-wide challenge to spur development of AI-based security tools. The European Central Bank is moving in parallel: it wants banks to submit detailed concepts for defending against AI-powered attacks by October 2026.
Open-Source Tool Aims to Close the Readiness Gap
To help manufacturers comply, the Fraunhofer Institute for Applied and Integrated Security (AISEC) has released an open-source tool called Codyze. It scans source code automatically for security requirements and supports Java, Python and C++. The tool comes with rule sets tailored to the CRA and to guidelines from Germany’s Federal Office for Information Security (BSI).
Despite these efforts, the scale of the challenge remains large. Many companies have yet to map their product inventory, set up continuous monitoring of their software supply chain, or assign clear ownership for security compliance. With penalties that can reach into the tens of millions, the September 2026 deadline is closing fast.
Disclaimer regarding our articles: No investment advice, no buy or sell recommendation. Information on prices, companies, and markets is provided without guarantee; changes are possible at any time. Stock market transactions can lead to substantial losses. Our articles are created and reviewed in whole or in part automatically with the support of AI.
