Thinking Thinking

News

ENISA scores EU cyber resilience at 71.53 as the CRA clock runs down

ENISA's biennial State of Cybersecurity in the Union report, published 10 November 2026, scores the EU at 71.53 out of 100 while Cyber Resilience Act product obligations arrive on 11 December 2027.

By Thinking Desk 2 min read

Key takeaways

  • ENISA published its NIS2 Article 18 report on 10 November 2026 with an EU Cybersecurity Index average of 71.53 out of 100.
  • Sub-scores are uneven: supply chain management 89.91, policy implementation 66.72, certification ecosystems 55.56 and national incident response maturity 54.76.
  • Cyber Resilience Act reporting obligations have applied since 11 September 2026, the date ENISA opened the CRA Single Reporting Platform.
  • The Act's main product obligations apply from 11 December 2027 and are evidenced through CE marking.
On this page
  1. What did ENISA report on 10 November 2026?
  2. What is the Cyber Resilience Act deadline for software vendors?
  3. Which obligations already apply?
  4. What it means for a small or mid-sized European operator

What did ENISA report on 10 November 2026?

ENISA published its State of Cybersecurity in the Union report on 10 November 2026 and scored the Union at 71.53 out of 100 on its own EU Cybersecurity Index. The report is not a voluntary exercise: it is the biennial assessment that Article 18 of the NIS2 directive requires. Behind the headline average the sub-scores are uneven. Supply chain management reaches 89.91 and research and development 79.24, while policy implementation sits at 66.72, certification ecosystems at 55.56 and the maturity of national computer security incident response teams at just 54.76. Cybersecurity in primary and secondary education scores 55.44 against 73.59 in higher education.

Executive Director Juhan Lepassaar said the report "reflects on the EU's collective effort and determination to become more resilient", while noting that "challenges persist and recent developments not only in frontier AI models but also cyber incidents" expose gaps. The report states that the level of cyber threats to the EU remains substantial, and tracks implementation of NIS2, the Cyber Resilience Act, the Cyber Solidarity Act, the proposed Cybersecurity Act 2 and the EU Action Plan on Cybersecurity and AI.

What is the Cyber Resilience Act deadline for software vendors?

11 December 2027. According to the Commission, the Cyber Resilience Act entered into force on 10 December 2024, its reporting obligations started on 11 September 2026, and its main obligations apply from 11 December 2027. It covers connectable hardware and software across the value chain, requires manufacturers to handle vulnerabilities over a product's lifecycle, and will be evidenced by CE marking. The Commission notes a special approach for free and open source software given its role in the ecosystem.

Weekly, Thursday morning, Central European Time.

The Thinking briefing

One email a week: what changed in European business software, which prices moved, and which comparison we published. No sales mail.

We store your address to send the briefing. One click unsubscribes you, and we never pass it on.

Which obligations already apply?

The reporting ones. Since 11 September 2026 manufacturers have had to report actively exploited vulnerabilities and severe incidents, and ENISA launched the CRA Single Reporting Platform on the same date. ENISA notes that open source software stewards come under the reporting duty later, from 11 December 2027. In other words, the part of the regulation that bites during an incident is already live, more than a year before the product requirements arrive.

What it means for a small or mid-sized European operator

If you sell software, or hardware with software in it, into the EU, December 2027 is a product deadline and not a paperwork deadline: it changes what you must be able to prove about your development process, your vulnerability handling and your support period. Two years is enough time only if the work starts in a budget cycle, so put it in the 2027 plan now. If you buy software, the practical move this quarter is to ask new suppliers how they intend to meet the CRA and whether they already report under the September 2026 obligation, because a vendor who cannot answer that is telling you something about its engineering. The index score that should worry a smaller buyer is the one for incident response maturity at 54.76: the national safety net is weaker than the average suggests, so your own backup and recovery plan carries more weight. Vendors documenting compliance for buyers can list their product through /en/get-listed, and operators reviewing the financial systems that would have to survive an incident can start with /en/best/best-accounting-software-luxembourg-2026.

Questions and answers

Does the Cyber Resilience Act apply to a small software vendor?
Yes, if the product has digital elements and is placed on the EU market. The Commission describes the scope as connectable hardware and software across the value chain, with a special approach for free and open source software. Size does not exempt you, although the obligations scale with the product's risk class.
What is the EU Cybersecurity Index?
It is ENISA's own composite measure, scored out of 100, used in this biennial report to compare Member States and policy areas. It is an indicator built by the agency, not an audit result, so read the sub-scores rather than the average.

Sources

Every price and fact above was checked against these pages on the date shown.

  1. [1] ENISA reveals the state of cybersecurity in the Union accessed 2026-11-11
  2. [2] European Commission: Cyber Resilience Act accessed 2026-11-11
  3. [3] ENISA: The CRA Single Reporting Platform is launched accessed 2026-11-11
Topics enisanis2cyber-resilience-actcomplianceeu-regulation