⁦Cyber Resilience Act (CRA)⁩

⁦European Union⁩ الأمن السيبراني

الحالة

⁦In force since 10 Dec 2024; reporting obligations apply from 11 Sep 2026; main obligations from 11 Dec 2027.⁩✓المصادر: ⁦digital-strategy.ec.europa.eu⁩, ⁦digital-strategy.ec.europa.eu⁩, ⁦hlc.com⁩

على من ينطبق

⁦Manufacturers, importers and distributors of hardware and software products with digital elements placed on the EU market, wherever they are based (consumer IoT, apps, software, components).⁩✓المصادر: ⁦digital-strategy.ec.europa.eu⁩, ⁦digital-strategy.ec.europa.eu⁩, ⁦mccannfitzgerald.com⁩

حدود الحجم

⁦None — applies regardless of size; no fines on micro/small firms for missing the 24h early-warning deadline.⁩✓المصادر: ⁦digital-strategy.ec.europa.eu⁩, ⁦eur-lex.europa.eu⁩, ⁦springlex.eu⁩

الجهة الرقابية

⁦National market surveillance authorities and CSIRTs; ENISA runs the Single Reporting Platform⁩✓المصادر: ⁦digital-strategy.ec.europa.eu⁩, ⁦digital-strategy.ec.europa.eu⁩, ⁦mccannfitzgerald.com⁩

الإبلاغ عن الخروقات أو الحوادث

⁦Actively exploited vulnerabilities and severe incidents: early warning within 24h, notification within 72h; final report 14 days after a fix (vulnerabilities) or 1 month after notification (incidents). Via ENISA Single Reporting Platform.⁩✓المصادر: ⁦digital-strategy.ec.europa.eu⁩, ⁦mccannfitzgerald.com⁩

الممثل المحلي

⁦Non-EU manufacturers may appoint an EU authorised representative; importers must ensure compliance.⁩✓المصادر: ⁦digital-strategy.ec.europa.eu⁩, ⁦mccannfitzgerald.com⁩

أقصى عقوبة

⁦Up to EUR 15m or 2.5% of worldwide turnover (essential requirements, Arts 13-14); EUR 10m or 2% (other duties); EUR 5m or 1% (misleading info).⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Report actively exploited vulnerabilities and severe incidents within 24h (from 11 Sep 2026).⁩
• ⁦Register on ENISA⁩'⁦s Single Reporting Platform and assign a reporting owner.⁩
• ⁦Design products to meet Annex I security requirements by 11 Dec 2027.⁩
• ⁦Define a support period and ship security updates throughout it.⁩
• ⁦Keep an SBOM and run a coordinated vulnerability disclosure policy.⁩
• ⁦Complete conformity assessment and CE marking before placing products on the market.⁩

التغييرات الأخيرة

⁦Reporting obligations went live 11 Sep 2026 with ENISA⁩'⁦s Single Reporting Platform; Commission published implementation guidance on 27 Jul 2026; delegated act on delayed CSIRT sharing adopted 11 Dec 2025.⁩✓

المصادر

• المصدر الأساسي: ⁦https://digital-strategy.ec.europa.eu/en/policies/cra-reporting⁩
• المصدر الثاني: ⁦https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/cyber-resilience-act-reporting-obligations-apply-from-11-september-2026⁩
• الجهة الرقابية: ⁦National market surveillance authorities and CSIRTs; ENISA runs the Single Reporting Platform⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.