The question that actually matters

Should your business simply strengthen cybersecurity, or also prepare a formal reporting capability for certain digital products? That is the decision sharpened by the Cyber Resilience Act, whose reporting obligations for actively exploited vulnerabilities and severe incidents start on 11 September 2026, according to the European Commission and EUR-Lex. The Commission published first implementation guidance on 11 September 2026 to help businesses apply the rulebook.

For an SME, this is not a legal nicety. It is an operating model question: who detects, who qualifies, who decides, who documents, who notifies, and on what timeline? The CNIL also reminds businesses that security, data minimisation, and governance must already be designed into data handling, including AI projects.

What changed, with the dates that matter

Primary announcement date: 11 September 2026, when the European Commission published its CRA implementation guidance. Operational date to remember: 11 September 2026, the start of the reporting obligations under the regulation for the products in scope.

The change is easy to say and harder to execute: a digital product sold on the market must now be treated like a living asset, with cybersecurity requirements across its whole lifecycle, not just at launch. The Commission describes the CRA as a horizontal cybersecurity framework, while EUR-Lex confirms the reporting trigger date.

The CNIL adds a useful layer of caution: with agentic AI, systems can be delegated to read, modify, or delete data. That increases the need for logs, access controls, and human validation for sensitive actions.

Which businesses are affected?

The clearest impacts fall on SMEs that design, assemble, integrate, distribute, or maintain digital products: software, connected devices, SaaS solutions with embedded components, connected production tools, or publishers that outsource parts of the stack but still place the product on the market. The Commission and EUR-Lex frame the CRA as a horizontal regime for products with digital elements, so the compliance impact travels up and down the supply chain.

SMEs that are not publishers can still be affected if they use AI or automation tools capable of acting on databases, desktops, or third-party applications. CNIL’s note on agentic AI highlights that capability, which means data processing risk can grow fast if controls are loose.

If your company does not place a digital product on the market, the effect is indirect but real: clients, buyers, or insurers may demand more evidence of security, traceability, and incident procedures. That is an inference from the regulatory tightening described by the Commission and from the increased buyer sensitivity to supplier risk.

Practical method: the 4-folder test

To decide quickly, use a 4-folder test in one shared directory. Folder 1: affected digital products and services. Folder 2: vulnerability and incident register. Folder 3: governance evidence, with roles and approvals. Folder 4: compliance and customer communication evidence. This turns an abstract obligation into something you can actually run. It fits the CRA logic and CNIL’s expectations around documentation and data security.

Fictional numerical example: a 28-person SME sells scheduling software that exchanges data with devices at customer sites. It does not sell “cybersecurity”, but it does sell an exposed digital product. In one week, it identifies 6 critical components, 2 decision owners, 1 single reporting channel, and 3 incident scenarios. The main cost is not software; it is people’s time — roughly 12 hours to set the process up and avoid discovering, during an incident, that nobody is authorized to send the report. This is a fictional illustration, not a market average.

What remains uncertain, and the useful limit of the news

The remaining uncertainty for many SMEs is not the existence of the rule, but the exact scope of hybrid products, how responsibilities are split between publisher, integrator, and distributor, and what authorities or customers will regard as sufficient evidence. Commission guidance helps, but it does not replace a product-by-product review.

Another limit: a good reporting process cannot compensate for weak basics. The CNIL says data security still rests on foundational measures such as restricted access, updates, backups, training, and an activity-appropriate diagnosis. In plain English: the CRA does not excuse sloppy admin rights.

If you use agentic AI, the caution is doubled: your systems may act on behalf of a human, but responsibility does not. The CNIL explicitly notes that these chains can be complex and partly opaque.

Seven-day action checklist

Day 1 — Owner: managing director. Observable result: dated list of exposed digital products and tools.

Day 2 — Owner: technical lead or IT provider. Observable result: inventory of critical components and external interfaces.

Day 3 — Owner: quality/legal lead or managing director. Observable result: simple incident triage grid: incident / vulnerability / false positive.

  • Day 4 — Owner: external security lead, IT manager, or provider. Observable result: one documented escalation and reporting channel.
  • Day 5 — Owner: operations. Observable result: ready-to-use incident form with timestamp, impact, actions, and decision.
  • Day 6 — Owner: HR or line managers. Observable result: a 10-minute instruction on who to alert and by when.
  • Day 7 — Owner: managing director. Observable result: written decision on CRA scope, open questions, and the next monthly review.