CRA: vulnerability and incident reporting is now mandatory

Since 11 September 2026, manufacturers report exploited vulnerabilities and severe incidents through ENISA's platform.