What is the Cyber Resilience Act?
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for hardware and software sold in the EU. It covers any product with a digital component that connects to a network or another device — which puts SAFEQ Cloud, SAFEQ 6, and Y Soft hardware, including card readers, in scope. For decades, the cost of insecure software has landed on customers and society while vendors faced few consequences. The CRA changes that: it makes security a legal obligation for manufacturers, not a competitive extra.
The obligation that started on September 11 (Article 14 of the CRA) covers one specific case: a vulnerability that's being actively exploited in the wild — not an ordinary bug, and not a theoretical risk with no evidence of exploitation. When that trigger is met, Y Soft reports it to ENISA on a fixed timeline: an early warning within 24 hours, a full notification within 72 hours, and a final report within 14 days to a month after a fix is available.
What this means for you and your customers
This is Y Soft's obligation, not yours or your customers'. Nothing changes about how you or your customers use SAFEQ Cloud, SAFEQ 6, or Y Soft hardware today. A new reporting requirement isn't a sign that Y Soft products have new vulnerabilities, and it doesn't change commercial terms or support agreements. What it does give you and your customers is legal certainty: if a real-world exploit affects a Y Soft product, Y Soft has to disclose it — not at its own discretion, but by law — and ENISA keeps a public record you can both check.
Part of Y Soft's Long-Standing Security Posture
Y Soft's ENISA reporting process is live and operational. It builds on security work Y Soft has invested in for years, including ISO 27001 certification and SOC 2 compliance, with FedRAMP and IRAP assessments now in progress. CRA compliance isn't a new initiative for Y Soft — it's the latest chapter in a security posture twe have built for years.
What comes next
This requirement is the first of two CRA milestones for Y Soft. The second lands on December 11, 2027, when full product conformity requirements — CE marking, technical documentation, and declared security support periods — apply to new SAFEQ placements.
Report a security issue
You, your customers, and independent researchers who find or suspect a security issue in a Y Soft product can report it directly here.
