Topic
EU legal framework covering the security of digital products, services and critical operators, including the Cyber Resilience Act and NIS2 Directive.
Modat and the Dutch cyber agency NCSC-NL found 8,547 internet-facing wind and solar control systems in 35 countries that were never meant to be online. One turbine page offers Start, Stop and Reset to anyone with a browser.
Reality
The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.
Perspective Coverage
5 publishersReality
EU Cyber Resilience Act rules have required 24-hour ENISA warnings on exploited flaws in commercial container images since Sept. 11, 2026. Vendors of supported Kubernetes operators and Helm charts are on the same clock, well before the rest of the law is enforced in December 2027.
Reality
The Commission's plain-language summary of Regulation (EU) 2024/2847 lays out staggered start dates for anyone shipping hardware or software into the EU, the earliest in June 2026 and the last in December 2027.
Reality
Politico reported that ENISA and CERT-EU ran an advanced OpenAI model over an EU project's code and got four fixed flaws out of it. Poland's CERT, doing the same kind of work, said it tested every hypothesis on real systems.
Reality