Cyber Resilience Act: The Reporting Clock Starts on September 11

EU Cyber Resilience Act reporting starts on 11 September 2026: 24h alert, 72h notification, 14-day report. Not a legal memo: the pipeline runbook, with SBOM in CI, govulncheck and a report template ready before the incident.