Observed Signal · Sep 10, 2026 · Corporate Update · Source: Element · Impact: 3.5/5
Cyber Resilience Act: What changes this week and how Element is preparing
Element outlines the impact of the first substantive Cyber Resilience Act (CRA) deadline on 11 September 2026, when Article 14 reporting obligations for actively exploited vulnerabilities and severe incidents take effect for manufacturers of products with digital elements. The company explains that its commercial product ESS Pro falls under these obligations, while open-source offerings like Element X and the Community Edition do not carry manufacturer duties. Element notes that the CRA's main requirements, including Annex I essential requirements, will become enforceable from 11 December 2027.
This update clarifies how the Cyber Resilience Act's staged reporting obligations apply to open-source versus commercial software products, affecting compliance strategies for Element and its customers across the EU. It signals a major regulatory milestone for digital product security in the European market.
Track Element Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- On 11 September 2026, Article 14 reporting obligations under the Cyber Resilience Act (Regulation (EU) 2024/2847) take effect for manufacturers of products with digital elements.
- The CRA entered into force on 10 December 2024 and applies in stages; 11 September 2026 is the second of three stages.
- Manufacturers must report actively exploited vulnerabilities or severe security incidents to the relevant CSIRT and ENISA: early warning within 24 hours, follow-up within 72 hours, and a final report within 14 days to 1 month.
- Element states that its commercial product Element Server Suite Pro (ESS Pro) is fully in scope, while Element X and the Community Edition of the Element Server Suite are not placed on the market and carry no manufacturer obligations.
- The main CRA obligations, including the essential requirements in Annex I, become enforceable in full from 11 December 2027.
- Element is working towards CE marking and evaluating the need for third-party certification.
Connected Companies & Entities
“Element is the company publishing the update and is directly affected as the manufacturer of the commercial Element Server Suite Pro (ESS Pr...”
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Only 3 in 10 firms know Cyber Resilience Act obligations
The European Cyber Resilience Act (CRA) will impose new reporting obligations starting September 11, 2026. Manufacturers must report actively exploited vulnerabilities and serious security incidents within 24 hours, followed by additional details within 72 hours and a final report. However, a Bitkom survey of 1,003 German companies reveals that only 29% understand the CRA's implications for their business. While 67% have heard of the law, many lack detailed knowledge. The central reporting platform will only go live on the deadline, hindering preparation. Bitkom supports the CRA's security-by-design principles but emphasizes the need for practical implementation.
AI won't absolve firms under EU Cyber Resilience Act
The article explains that the EU Cyber Resilience Act (CRA), in force since December 2024, imposes strong security and liability obligations on any product with digital elements placed on the EU market. Key CRA deadlines: vulnerability reporting to ENISA becomes mandatory in September 2026 and full compliance is required by December 2027. Obligations include shipping products without known exploitable vulnerabilities, providing security updates for a minimum five-year supported lifetime, CE marking for covered products, 24-hour reporting of actively exploited vulnerabilities to ENISA, and fines up to €15 million or 2.5% of global turnover. The author warns that AI-assisted code (Copilot, Claude, Cursor examples) carries the same legal weight as handwritten code and recommends inventories, 24-hour reporting pipelines, AI-code audits, documented vulnerability-handling processes, and SLA updates.
German Industry Struggles with Cyber Resilience Act
A Retail-News article (29 Aug 2026) reports on the ONEKEY “IoT & OT Cybersecurity Report 2026”, finding many German companies are insufficiently prepared for the EU Cyber Resilience Act (CRA). The study shows significant gaps in awareness, with 45% of firms little or not familiar with CRA requirements, limited knowledge of the first reporting deadline (11 September 2026), and slow progress on risk management, documentation, SBOMs, security updates and 24-hour incident reporting. The report warns that AI-driven attacks and the complexity of software transparency increase urgency. Many companies aim for full compliance by December 2027 but need to accelerate implementation.
Receive all future signals for Element & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.