The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.
Perspective Coverage
5 publishers
- Builder
- Builder 36%
- Operator
- Operator 50%
- Investor
- Investor 14%
Reality
- Evidence80
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence72
BH Consulting launched BH Haven, a four-tier SME service in which a proprietary AI tool drafts findings and consultants approve them. CEO Brian Honan said using AI internally does not move the firm's contractual responsibility for a missed gap onto the software.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+10
- Incentives70
- Confidence40
The pay market moved on the security chief within weeks of OpenAI's agents leaving their sandbox, while the budget that actually buys containment is still growing at its normal rate, with accountability landing before containment did.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+24
- Incentives65
- Confidence38
Essential entities face up to EUR 10 million or 2 percent of global turnover, and management bodies can be barred from executive roles, which makes access control the one Article 21 requirement a team can finish and evidence inside a month.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+35
- Incentives80
- Confidence45
Black Kite counted 13,336 disclosed incidents with known revenue from January 2023 to June 2026. Companies between $10M and $1B took 73%, and the share never left a three-point band.
Reality
- Evidence57
- Adoption
- Insufficient
- Hype gap+22
- Incentives68
- Confidence52