Incident Reporting Starts Sept. 11, Other Mandates Wait Until Dec. 11, 2027 The European Commission published final guidance for complying with the Cyber Resilience Act, a 2024 law that aims to boost the cybersecurity of software and internet-connected hardware products. The greatest change from a previous draft is which software falls within the CRA’s scope.