EU CRA and BSI TR-03183: What Grid Tech Vendors Must Do Now

Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities via a platform ENISA is establishing. SBOM and vulnerability handling under CRA Annex I become mandatory on 11 December 2027. BSI TR-03183 serves as implementation guidance.

• Reporting obligation for exploited vulnerabilities applies since 11 September 2026
• SBOM and Annex I vulnerability handling become mandatory on 11 December 2027
• BSI TR-03183 requires machine-readable SBOMs and a vulnerability intake channel
• Critical categories: smart meter gateways, firewalls, VPN routers