How CISOs Should Navigate a Growing UK-EU Cyber Compliance Squeeze

September 2026, Daryl Flack, Partner

Published on: infosecurity magazine

From September 11, manufacturers selling connected products into the EU will have just 24 hours to report actively exploited vulnerabilities under the EU Cyber Resilience Act (CRA) – potentially before they have the complete picture.

But the 24-hour clock is only the most immediate pressure facing CISOs.

As the UK’s Cyber Security and Resilience Bill progresses, organizations face a growing mix of UK and EU requirements covering supplier risk, vulnerability reporting and operational resilience.

The simplest way of looking at the two is that the Cyber Security and Resilience Bill is largely about operator-side supply-chain control, while the CRA comes at it from the product side through vulnerability and incident reporting.

They are coming at broadly the same resilience problem from different ends of the spectrum. CISOs need to understand both and avoid turning them into separate compliance exercises.

The UK Puts High-Risk Suppliers in the Spotlight

The Government wants much stronger levers to strengthen the UK’s critical national infrastructure (CNI) sectors and de-risk critical infrastructure from state-linked or otherwise high-risk suppliers and, crucially, to be able to act quickly when it needs to.

The proposed powers would allow ministers to direct operators to put additional controls in place, phase out particular vendors or, where necessary, ban them altogether. There is also a voluntary self-referral route, giving organizations an opportunity to get an early risk view on a supplier before they sign on the dotted line.

For CISOs, that could be really useful. Nobody wants to get six months into a contract with a critical supplier only to discover that the regulatory or geopolitical picture has changed and they now need to work out how to remove them.

This is going to push those conversations much further upstream. It is no longer enough to ask whether a supplier is secure. CISOs increasingly need to understand who owns them, where they are based, which jurisdictions they operate in, what their support model looks like and, crucially, what the exit looks like if that supplier suddenly becomes a problem.

There is still some parliamentary road to travel before these measures take effect. Further Lords committee sittings are taking place, and we are already seeing some interesting pushback, particularly around AI. Peers have questioned why responsibility should sit with operators using AI rather than the vendors building it, while the Government maintains the Bill should remain technology-agnostic.

Royal Assent is expected later in 2026 if the timetable stays on track. But that will not really be the finish line for CISOs. Much of the detail that matters operationally, particularly around high-risk vendor directions and procurement, will likely come afterwards through secondary legislation and guidance.

The temptation will be to wait for that detail. But there is already enough here for CISOs to start working out where their supplier exposure sits, which relationships could present a problem and, most importantly, how they would respond if a critical vendor had to be removed.

The CRA Puts Manufacturers on the Clock

While the UK Bill is focused largely on operator-side supply-chain control, the CRA puts the pressure on manufacturers.

Article 14’s 24-hour reporting requirement is a pretty unforgiving window. Manufacturers need to establish whether a vulnerability is genuinely being actively exploited, bring in the right technical and legal people and get the regulatory notification out the door. Further reporting follows at 72 hours and then a fuller report.

And this is not just an EU vendor issue. UK and US manufacturers selling relevant products into the EU are caught too, including legacy products already in distribution, not simply whatever gets launched after September 11.

The reporting clock also starts well before many of the CRA’s wider engineering obligations kick in. Manufacturers could therefore be reporting vulnerabilities in products they are not yet formally required to “fix” under the full CRA regime.

That could create tension between vendors and operators, particularly around what “actively exploited” means in practice and when everyone agrees that the 24-hour clock has actually started.

For CISOs, the two regimes create different obligations, but the underlying resilience challenge increasingly needs to be managed as one.

Map Exposure and Know Your Exit

Start by mapping which services are likely to sit within the scope of the Cyber Security and Resilience Bill and which product lines fall under CRA Article 14.

Then test whether the organization could actually meet the CRA reporting requirement. Getting engineering, security, legal, compliance and leadership aligned quickly enough to make that call is challenging. Roles and decision-making responsibilities need to be clear before an incident occurs.

High-risk vendor decisions also need a much more structured process. CISOs should be looking at ownership and jurisdiction, support models, SBOMs, patching SLAs, Cyber Essentials assurance and, importantly, exit options.

Identifying a risky supplier is one thing. Working out how to isolate or replace a critical component without taking an essential service down is something else entirely.

CISOs need playbooks for supplier removal, rather than trying to invent one when a direction lands.

Contracts need the same scrutiny. Incident notification timelines, vulnerability disclosure, software bills of material (SBOM) delivery, remediation responsibilities and indemnities all need another look. I would pay particular attention to AI and managed-service providers, because that is where dependencies can get complicated very quickly.

Make Resilience the Board Conversation

Some CISOs are effectively juggling three overlapping regimes – the EU’s NIS2 directive, the UK Cyber Security and Resilience Bill, the CRA and existing sector rules. Running those as separate compliance exercises is going to become unwieldy very quickly.

The differentiator will be whether CISOs can turn them into one coherent resilience conversation at board level.

What could cause downtime? What would that downtime cost us? Where are we carrying regulatory exposure? And where have we concentrated too much dependency in one supplier?

Because ultimately that is what boards need to understand. Not another regulatory acronym, but can the business keep operating when regulatory, geopolitical or cyber risk suddenly makes a critical supplier untenable?

That is the real test behind this growing UK-EU compliance squeeze. Not whether an organization can satisfy each regime in isolation, but whether it has the visibility, processes and exit plans to keep operating when risk turns into reality.