Cybersecurity in the final stretch of 2026: CRA, AI Act, NIS2 and the milestones after summer

September usually means business resumes: projects restart, budgets move again and decisions parked during August return to the table.

In 2026, the return also comes with a particularly dense cybersecurity, technology regulation and digital resilience agenda. Not every milestone affects every organisation in the same way, but together they show a clear direction: Europe is no longer asking only for system protection; it also expects governance, product security, third-party management and evidence that controls work.

11 September: CRA reporting begins

On 11 September 2026, the Cyber Resilience Act (CRA) reporting obligations begin to apply. From that date, manufacturers must report actively exploited vulnerabilities and severe incidents affecting products with digital elements through the single reporting platform provided for by the Regulation.

For an actively exploited vulnerability, Article 14 establishes an early warning within 24 hours, a fuller notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available. Severe incidents also follow the initial 24- and 72-hour sequence, with a final report within one month.

The CRA will not apply in full until 11 December 2027, but this September it stops being only a rule to prepare for the future. Timely reporting requires knowing which products are maintained, which components they use, how vulnerability intelligence arrives, who assesses severity and who can escalate an incident.

12 September: the Data Act and connected products

The Data Act has generally applied since September 2025, but it reserves a milestone for connected products and related services placed on the market after 12 September 2026. From then on, the Article 3(1) obligation applies: they must be designed so that product and related-service data are accessible to the user by default, easily, securely, free of charge and in a usable format.

This is particularly relevant to automotive, IoT, industry, machinery and digital services associated with physical products. Although the Data Act is not a cybersecurity regulation, it raises security questions: who can access the data, through which interface, which third parties are involved and how that information is protected.

For connected-product manufacturers, the Data Act and CRA should be assessed together. Separating them creates two inventories, two architecture conversations and, often, two evidence sets for the same product.

The AI Act has entered a new phase

Since 2 August 2026, the AI Act has been generally applicable, subject to the exceptions and specific dates retained in the Regulation. Article 50 transparency obligations also apply: informing people when they interact with certain AI systems, marking synthetic content in a machine-readable format, and labelling certain deepfakes and public-interest text.

At the same time, the AI Office and national authorities have entered a new enforcement phase. This does not mean every high-risk obligation already applies: following Regulation (EU) 2026/1744, a substantial part has moved to December 2027 and August 2028.

For many companies, the first challenge is more basic: which AI systems they use, for which processes, what data they receive, who authorised them, which provider sits behind them and how outputs are supervised. It is difficult to govern technology that has not even been inventoried.

2 December: a specific AI transition and new prohibitions

On 2 December 2026, the four-month transition ends for providers of systems that generate synthetic content and were already on the market before 2 August to meet the marking and detection obligations in Article 50(2).

New prohibitions added by the AI Digital Omnibus also start applying on that date. This milestone must not be confused with full application of the entire AI Act: its schedule remains phased.

NIS2: Spain still has unfinished business

Spain has not completed its NIS2 transposition. The EU deadline was 17 October 2024 and, on 8 July 2026, the Commission decided to refer Spain, Ireland, France and the Netherlands to the Court of Justice of the European Union for failing to notify complete transposition. The referral requests a lump sum and daily penalties until complete transposition is notified.

As at 31 August, there is no official date supporting a claim that the Spanish law will pass in September, October or December. That does not make waiting a good strategy: risk management, supplier security, incident response, continuity, access control and vulnerability management cannot be deployed overnight. To locate your case, use the NIS2 checklist and the analysis of what NIS2 currently means in Spain.

October: European Cybersecurity Month

October will again be European Cybersecurity Month, the annual awareness campaign promoted by Member States with support from ENISA and the European Commission.

It is less regulatory, but potentially more useful to many companies. Credentials, human error, poor configuration and outdated systems still feature in incidents. The opportunity is to work on behaviour and processes, not merely send an annual course or a phishing simulation.

11 December: CRA conformity infrastructure

The Commission timetable expects a sufficient number of conformity assessment bodies to be notified across Member States by 11 December 2026. The fourth quarter should also bring progress on the presumption of conformity between the European EUCC certification scheme and the CRA.

This is less visible than incident reporting, but it is necessary for product assessment and certification to work when the Regulation becomes fully applicable in 2027.

Before the end of 2026: European digital identity

Member States must provide at least one European Digital Identity Wallet (EUDI Wallet) within the deadline established by the European digital identity framework; the Commission places availability before the end of 2026.

The wallet will support identification with public and private services, storage of credentials, selective sharing of attributes and certain signatures. From a cybersecurity perspective, it puts strong authentication, privacy, data minimisation and fraud prevention at the centre.

Before the end of 2026: the post-quantum transition begins

The European roadmap for post-quantum cryptography (PQC) recommends that all Member States should have started their transition by the end of 2026. Critical infrastructure should migrate as soon as possible and no later than the end of 2030.

This does not mean replacing all cryptography tomorrow. The first step is knowing where it lives: certificates, TLS, VPNs, PKI, signatures, devices, applications and suppliers. Only then does crypto-agility become practical: the ability to change algorithms, protocols or implementations without rebuilding entire systems.

Use September to review the fundamentals

With so many rules and dates, cybersecurity can easily become a compliance calendar. That would be a mistake. The return after summer is a good time to check:

1. Assets: which systems, services and products actually exist.
2. Identities: whether only those who need access still have it.
3. MFA: whether it is deployed where needed with robust methods.
4. Updates: what remained pending during the holidays.
5. Suppliers: which external access routes exist and when they were last reviewed.
6. Backups: whether a restore has recently been tested.
7. Incidents: who decides, who must be called and which deadlines apply.
8. AI: which uses are inventoried and who supervises them.
9. Connected products: whether the CRA and Data Act affect what is developed or sold.
10. Cryptography: where the dependencies that will need migration are located.

From September to December, product security, artificial intelligence, access to device data, digital identity and post-quantum cryptography will all move forward at once. Beneath all those acronyms lies the same question: do we understand our risks, and do we have controls that work when we need them?

Regulation will keep changing. The fundamentals of sound cybersecurity management, much less so.