CRA: Could Your Team Report a Vulnerability in 24 Hours?

A webinar on the Cyber Resilience Act’s 24-hour clock. Since 11 September 2026, manufacturers selling connected devices in the EU must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability in their product, followed by a full notification within 72 hours. That includes manufacturers outside the EU, such as US companies selling through EU distributors.

The 45-minute session follows a realistic incident hour by hour, from the first email to the final report, and covers what the CRA expects of your firmware by December 2027. You leave with a readiness test and a checklist for your team. It is practical, not legal advice, and aimed at engineering leads, product security, and anyone accountable for the CRA in their company.

It’s a Spotflow webinar, where I work, presented by Jan Kučera, Spotflow’s co-founder. Registration is free.