Cyber Resilience Act: Logika Control discusses the new obligations on ElettronicaTech

September 2026

From September 11, 2026, the first reporting obligations provided for by the CRA will be applicable. Logika Control analyzes the implications and operational aspects in the article published on ElettronicaTech.

The Cyber Resilience Act enters a new phase

With the publication on ElettronicaTech of the article “Cyber Resilience Act: reporting obligations come into force on September 11, 2026”, Logika Control draws attention to one of the first operational deadlines of the new European regulatory framework for the cybersecurity of products with digital elements.

The contribution, signed by Lorenzo Labella, Cybersecurity Specialist, and Paolo Nozza, R&D Director at Logika Control, It examines the obligations that became applicable from September 11, 2026, and, above all, what they actually mean for manufacturers of embedded devices.

From this date, manufacturers must notify the vulnerabilities actively exploited and serious incidents affecting the safety of products. The prescribed timelines require an initial warning within 24 hours of becoming aware of the event and a more comprehensive notification within 72 hours.

Deadlines that bring a fundamental aspect to the fore: in order to intervene quickly, The vulnerability management process must already be structured, documented, and integrated into product management.

From the vulnerability to the product involved

Knowing that there is a vulnerability is only the starting point.

To understand its real impact, it is necessary to relate it to the components present in the firmware and to the specific characteristics of the affected products. It is at this step that the article focuses a significant part of the analysis, showing why managing vulnerabilities requires a structured and continuous process.

Among the topics covered are SBOM, CVE monitoring, technical triage, and traceability of assessmentsDifferent elements but closely linked when it is necessary to move from simply detecting a possible vulnerability to understanding its actual relevance to the product.

The article delves into the details of this process, explaining also why an automatic result is not sufficient on its own to determine the actual exposure of a device.

A process that must evolve alongside the firmware over time

The CRA thus highlights an approach to cybersecurity that cannot be limited to intervening when a problem arises.

Knowing the components used, following their evolution, and keeping track of the evaluations performed become part of an activity that accompanies the firmware throughout its lifecycle.

In the article, Lorenzo Labella and Paolo Nozza They describe this passage through their experience at Logika Control and the work developed within the framework of the Firmware Maintenance, It shows how to organize the different phases that lead from the identification of a vulnerability to its technical evaluation.

The complete in-depth article on ElettronicaTech

This publication on the Cyber Resilience Act is part of a series of articles produced by Logika Control for ElettronicaTech, created to share skills and experience regarding the changes affecting cybersecurity and the development of industrial electronic devices.

An editorial journey that addresses regulatory and technological issues starting from the concrete implications these can have for those who design, develop, and maintain embedded products.

To learn in detail the obligations set out by the CRA and the process that links SBOM, vulnerabilities and technical assessment, Read the full article “Cyber Resilience Act: reporting obligations come into force on September 11, 2026” on ElettronicaTech.