The EU CRA vulnerability reporting deadline is September 2026. Here's the checklist your team needs to be ready — organized into two phases with specific action items for each.