As of Friday, 11 September 2026, Article 14 of the European Union's Cyber Resilience Act (CRA) is live. Manufacturers of products with digital elements must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe product-security incident, and a full notification within 72 hours, through the European Union Agency for Cybersecurity (ENISA) Single Reporting Platform (SRP). One filing reaches the Computer Security Incident Response Team (CSIRT) of main establishment and, unless exceptional grounds apply, ENISA at the same time. Products already on the market are in scope. A final report follows no later than 14 days after a corrective measure for exploited vulnerabilities, or within a month of the 72-hour notice for severe incidents.

FLAG: calendar go-live, not a sudden scoop. Different statute from Tuesday's Artificial Intelligence Act Article 55 filing. Lead CRA product-with-digital-elements vulnerability and incident reporting, not the AI Act. Open-source software steward reporting under Article 24(3) starts 11 December 2027, not today. Tier-1 fines can reach €15 million or 2.5% of global annual turnover, whichever is higher; treat that as fine machinery whose full CRA application date is still 11 December 2027. (European Commission; Travers Smith)

Salesforce on September 10 put a name on the control layer it wants around enterprise agents: the Trusted Enterprise AI Harness. Six capabilities: context, agency, action, governance, security, and models. Beside them, a new AI Control Plane to register agents, set identity and policy, manage lifecycle, watch behavior, and track cost across Salesforce and third-party models. Take the stack whole or compose the pieces. Much of the foundation ships now; the unified experience is planned to start rolling early in fiscal FY28.

This is product packaging, not a statute. Read it as the vendor-architecture reply to the same control questions the CRA clock raises for anything that ships with software attached. (Salesforce)

Anthropic's September Threat Intelligence report on disrupted Claude misuse across seven harm areas, including biological dual-use research and conventional-weapons software, landed Thursday. Techpresso carried the same package Friday. Accounts banned. Safeguards hardened. Intelligence shared with partners where it made sense.

FLAG: Techpresso Friday covered. Amp only. Do not treat as today's unique miss. Keep it off Friday's Lehane lead and off the CRA clock. Stick to Anthropic's disclosed framing. No methods. (Anthropic)

OpenAI's Chris Lehane still has the ask in writing: mandatory, capability-based national artificial intelligence safety rules before Congress adjourns, and four California bills as reverse federalism until Washington moves. Friday's coverage kept that window open. The Klobuchar-Cruz-Thune Hill draft is still not public.

FLAG: Friday already led this. Do not re-scoop the mandate today. Keep it as the open US floor sitting beside Europe's product-security clock. (OpenAI)

A European Commission spokesperson confirmed that ENISA is now testing Anthropic's Mythos 5 alongside OpenAI's GPT-6 Astra. Astra reached ENISA about a week after release. Mythos took months of negotiation after the spring cyber claims and parliamentary pressure.

Two frontier stacks under sovereign cyber-eval at once. Neither Brussels nor Anthropic has said which Mythos configuration ENISA actually got. Leave that gap on the diligence list. (The Next Web)

The Medicines and Healthcare products Regulatory Agency (MHRA) published the National Commission's healthcare AI blueprint on September 10. The headline moves are "L-plate" staged authorisations under tight guardrails, continuous real-world monitoring across a device's working life, public searchable safety information, and tougher MHRA enforcement powers. More than 12,000 people fed the evidence base. Formal government response still to come.

Healthcare vertical. Same trust shape as the rest of the week: stages, monitoring that survives deployment, a regulator with teeth. (GOV.UK)

Put four questions on one page before the next product that ships software into the European Union. Who decides that the manufacturer has a "reasonable degree of certainty" an exploited vulnerability or severe incident has occurred, so the 24-hour early-warning clock actually starts. Which CSIRT gets the first SRP filing for each product line, including for manufacturers with no EU establishment. How is user notify drafted and approved before the clock starts, without waiting for a supplier to return a call. How does the CRA path sit next to the Network and Information Systems Directive (NIS 2) and the General Data Protection Regulation (GDPR) on the same incident.

A known deadline that just went live still needs names, a tree, and a dry-run. (European Commission)

The Move

Friday was the floor ask. Today is the CRA clock.

Send legal, product security, and the AI owner a one-pager: who owns the 24-hour early warning, which CSIRT each product line files to, how user notify is staged before the clock starts, and how CRA, NIS 2, and GDPR share one incident tree.

If SRP access and the escalation list are still "we'll set that up when something hits," put the blank next to every product with digital elements already shipping in the EU.

Seven bullets. One move.