From 11 September 2026, new reporting obligations under the Cyber Resilience Act started to apply, introducing strict timelines for the notification of actively exploited vulnerabilities and severe security incidents affecting products with digital elements. 

Understanding the regulatory requirements is essential. But organizations also need to be ready to manage the incident and notification process when requirements are triggered. 

What needs to be reported? Who needs to be involved? What information is available in the first 24 hours? And how can organizations manage incident response and notification in parallel while the situation, and the information available, continues to evolve? 

In this webinar, Drivesec and Code Blue will combine regulatory and operational perspectives to address both sides of the challenge. 

Drivesec will provide an overview of the CRA reporting requirements taking effect on 11 September 2026, explaining what needs to be reported, when and by whom, and the practical steps organizations should take to prepare. 

Code Blue will focus on incident response and notification in practice: how to assess and manage an incident, gather and validate the information required for reporting, coordinate the relevant stakeholders, manage the 24-hour and 72-hour timelines, and maintain an effective notification process as new information becomes available. 

Together, Drivesec and Code Blue will help organizations navigate the new requirements and prepare for the operational challenges of incident response and notification.