EU Cyber Resilience Act

Security information for Octbe

Pe scurt: Actul privind reziliența cibernetică este un regulament UE, nu o directivă. Se aplică direct. Obligațiile de raportare curg din 11 septembrie 2026. Obligațiile de produs, inclusiv declarația de conformitate și marcajul CE, curg din 11 decembrie 2027. Octbe nu afișează marcajul CE, pentru că evaluarea nu este încheiată.

Regulation (EU) 2024/2847, the Cyber Resilience Act, is the Union rule for hardware and software with digital elements made available on the Union market. The Commission describes it as the duty to design, update and maintain those products so that buyers can tell which ones have the required cybersecurity properties. This page is Octbe’s public status against that rule.

Last updated: 2 November 2026

No CE mark on this page. The Act says products carry the CE mark to show they meet its requirements. That mark, and the EU declaration of conformity, may be published only after the conformity assessment for that product has a positive result. Octbe’s assessment is not finished. This page is not that declaration, and it is not legal advice.

1. What the Act requires

The Act is a regulation. Unlike the NIS2 Directive, it does not wait for a national transposition law. It applies directly in every Member State. It sits beside NIS2. The Commission’s practical guidance for manufacturers was published on 27 July 2026. The official summary is the Commission page on the Cyber Resilience Act.

For a manufacturer, the duties the Act describes are:

  • Security by design and by default, from planning through development, production and maintenance.
  • A cybersecurity risk assessment, kept in the technical documentation.
  • Care with third-party components, so they do not weaken the product.
  • Handling of vulnerabilities for the whole support period, with security updates that are timely and free of charge.
  • A software bill of materials where the Act requires one, so known vulnerable components can be seen.
  • User instructions, including the end of the support period by month and year.
  • For some products that are important or critical, an assessment by a notified body before they are sold.
  • After a positive assessment, the EU declaration of conformity and the CE mark. Market-surveillance authorities enforce the rules.

Importers and distributors also have to check that what they place on the market carries the mark and the user information. Octbe is published by its own operator. It is not presented here as an imported device.

2. What Octbe is

Octbe is hosted procurement software. It is meant to help business teams see spend, supplier performance, savings progress, and procurement reporting. It is not a consumer device, and it is not sold as a physical product.

3. When the duties start

  • 10 December 2024. The Act entered into force. Adopted on 23 October 2024.
  • 11 June 2026. The rules on notifying conformity assessment bodies apply.
  • 11 September 2026. Manufacturers report actively exploited vulnerabilities and severe incidents that affect the security of the product.
  • 11 December 2027. The product duties apply, including Annex I, the declaration of conformity and the CE mark, for products placed on the market from that date.

A product placed on the market before 11 December 2027 is outside the product requirements, except the reporting duty, unless it is substantially modified. A declaration of conformity will be linked from this page only after the assessment for Octbe is actually done.

4. Support and updates

Security updates for the hosted service are applied while the service is offered. When the support-period duty applies, this page and the customer agreement will state the end date with a month and a year. That date is not invented in advance.

The operating system and the application runtime on the host are updated as patches are published. An update reduces known risk. It does not mean the service has no vulnerabilities.

5. How a problem is reported

Email [email protected] with the subject “Security”. Describe the issue, the page or account affected, and the steps to see it. Do not include passwords, customer procurement files, or data that belongs to someone else. Give Octbe a reasonable time to fix the issue before any public write-up.

From 11 September 2026 the official report goes once, through the single reporting platform run by ENISA, to the CSIRT of the Member State of the main establishment. The deadlines in the Act are:

  • an early warning within 24 hours of becoming aware;
  • the full notification within 72 hours;
  • a final report within 14 days after a corrective measure is available, for an actively exploited vulnerability;
  • a final report within one month of the 72-hour notification, for a severe incident.

That official report does not replace the form below. A customer can still write to [email protected].

Report a vulnerability

No account is required. The report is stored and a reference is shown here. The 24-hour and 72-hour clocks start when it is saved. Do not include passwords or someone else’s files.