Insights

Latest / featured

Y Soft Opens Vulnerability Reporting Channel Under the EU Cyber Resilience Act

Sep 22, 2026

From 11th September 2026, anyone — you, your customers, or independent security researchers — can report a suspected vulnerability in a Y Soft product directly to us. It's part of our response to the EU Cyber Resilience Act (CRA), in force since 11th September 2026: Y Soft must now report actively exploited vulnerabilities to ENISA within 24 hours, and file a full report within 72. We built the process to meet that deadline — and opened it to everyone, not just regulators.

What is the Cyber Resilience Act?

The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for hardware and software sold in the EU. It covers any product with a digital component that connects to a network or another device — which puts SAFEQ Cloud, SAFEQ 6, and Y Soft hardware, including card readers, in scope. For decades, the cost of insecure software has landed on customers and society while vendors faced few consequences. The CRA changes that: it makes security a legal obligation for manufacturers, not a competitive extra.

The obligation that started on September 11 (Article 14 of the CRA) covers one specific case: a vulnerability that's being actively exploited in the wild — not an ordinary bug, and not a theoretical risk with no evidence of exploitation. When that trigger is met, Y Soft reports it to ENISA on a fixed timeline: an early warning within 24 hours, a full notification within 72 hours, and a final report within 14 days to a month after a fix is available.

What this means for you and your customers

This is Y Soft's obligation, not yours or your customers'. Nothing changes about how you or your customers use SAFEQ Cloud, SAFEQ 6, or Y Soft hardware today. A new reporting requirement isn't a sign that Y Soft products have new vulnerabilities, and it doesn't change commercial terms or support agreements. What it does give you and your customers is legal certainty: if a real-world exploit affects a Y Soft product, Y Soft has to disclose it — not at its own discretion, but by law — and ENISA keeps a public record you can both check.

Part of Y Soft's Long-Standing Security Posture

Y Soft's ENISA reporting process is live and operational. It builds on security work Y Soft has invested in for years, including ISO 27001 certification and SOC 2 compliance, with FedRAMP and IRAP assessments now in progress. CRA compliance isn't a new initiative for Y Soft — it's the latest chapter in a security posture twe have built for years.

What comes next

This requirement is the first of two CRA milestones for Y Soft. The second lands on December 11, 2027, when full product conformity requirements — CE marking, technical documentation, and declared security support periods — apply to new SAFEQ placements.