From 11 September 2026, the Cyber Resilience Act starts its clocks. A manufacturer that learns of a vulnerability under active exploitation in a product sold in the EU has 24 hours to send an early warning, 72 hours to file a notification, and, once a fix or mitigation is available, 14 days to deliver a final report. From 11 December 2027 the rest of the regulation applies: security updates for the whole support period, vulnerability handling as a legal duty, and fines that reach €15 million or 2.5% of worldwide turnover.
A wave of compliance tooling is forming around those clocks: SBOM generators, report templates, evidence vaults. Fair enough. The paperwork is mandatory and someone should automate it. But the paperwork measures the incident. It does not shorten it.
The number no report contains
What decides how bad the day gets is the distance between the version you run and the version that carries the fix. When the patch lands one version away, the fix is a bump: CI passes, the PR merges, the report reads like a footnote. When the patch lands three majors away, there is no patch for you. There is a migration: renamed APIs, a config rewrite, transitive conflicts, a test suite full of opinions. Same CVE, same 24-hour clock. One team files “fixed”; the other files “assessing impact” for the third week.
You set upgrade distance months before the CVE drops. A dependency that gets bumped every week can be fixed in a day. A dependency nobody has touched since 2023 cannot, on any deadline you would sign. Keeping dependencies current stopped being hygiene. Under the CRA it is the difference between an update and an incident.
Current does not mean bleeding edge. Brand-new releases carry their own risk, and the sane policy is a soak window: days behind latest, never years behind. We wrote that argument up on its own.
Two questions, two kinds of tooling
StackRadar is not a compliance platform. It does not generate SBOMs, file ENISA notifications, or assemble audit binders. Keep whatever does. StackRadar works the side of the CRA that paperwork cannot reach: one ranked backlog across every project, agents that write the upgrade the fix needs, your CI as the gate, your policy as the merge button, and a remediation SLA board that records how fast it all happened.
The regulation asks two questions: did you tell us, and did you fix it. Report templates answer the first. StackRadar exists for the second. And the best position to hold on 11 September 2026 is not a faster report. It is running versions the report never has to mention, because the affected release is one you left behind months ago.