Article 2(2)(c) Exempts Your Vehicle From the EU Cyber Resilience Act. It Doesn’t Exempt What You Bolted to It
On 11 September 2026, the notification obligations under the EU Cyber Resilience Act (Regulation (EU) 2024/2847) go live. A 24-hour early warning, a 72-hour notification, a final report to ENISA and the relevant national CSIRT within 14 days. Since the date landed, most of the automotive cybersecurity conversation has treated it as a new clock…