The Cyber Resilience Act Explained
ServiceNow, Tuesday, August 11th, 2026
ServiceNow explains the EU Cyber Resilience Act, its phased deadlines and penalties of up to EUR 15 million.
ServiceNow explains the EU Cyber Resilience Act, which makes strong cybersecurity a prerequisite for market access in the EU and requires products to be secure by design, by default and throughout their lifecycle.
Obligations include reporting exploited vulnerabilities or significant incidents to regulators within 24 hours, providing security updates across the product's expected lifetime, and applying CE marking.
The act entered into force on 10 December 2024 with phased obligations: from 11 September 2026 manufacturers must report incidents to the relevant CSIRT within 24 hours, and full enforcement begins 11 December 2027. Non-compliance can bring product withdrawal plus fines up to EUR 15 million or 2.5% of prior-year revenue.