The CRA's 24-hour clock went live on September 11. If your enterprise camera sells in the EU, it already applies.

The CRA’s 24-hour clock went live on September 11. If your enterprise camera sells in the EU, it already applies. [unverified]

On September 11, 2026 manufacturers of “products with digital elements” sold in the EU — explicitly including network-connected cameras — started having to report “actively exploited vulnerabilities” to ENISA within 24 hours (early warning), 72 hours (detailed notification), and 14 days after a corrective measure becomes available (final report) [1][3]. The penalty for non-compliance: up to €15M or 2.5% of global annual turnover [3][4]. This is 15 months ahead of the CRA’s full application date (December 11, 2027) [1][4] — the clock started. ENISA’s Single Reporting Platform centralizes the manufacturer reports [3][4].

( the CRA’s “PDEs” include “back-end or cloud services that are necessary for those products to perform their functions” — the cloud that runs your camera is in scope, not just the hardware [2][4] )

Three events from September 11-18 converge into one question for your next enterprise CCTV RFP: where does the AI model run? [unverified] On September 17 VerkadaOne 2026 (Miami, 2,500 attendees) announced Catalyst — a read-only Model Context Protocol integration that connects “approved third-party AI platforms including Claude, ChatGPT and Gemini” to the same Verkada Command console where the footage lives [5][6]. The same week Verkada also launched Verkada Transportation (3 ruggedized cameras + KGX61 5G/Wi-Fi gateway) extending Command into vehicles and the fleet edge [6]. The LLM is no longer a swappable service — it is a default feature inside the vendor console [5][6]. On September 18 Governor Newsom signed Executive Order N-9-26 convening an expert panel to deliver within 2 months a guide on “AI kill switch” + onsite independent verification for frontier AI labs [7][9]. EFF responded the same day, naming “AI-powered surveillance systems such as Flock cameras” among the immediate harms any AI regulation should address first [8].

The editorial question: if your vendor has to report AEVs to ENISA within 24 hours, what part of your RFP requires written evidence of compliance — before the fine, before the incident, before the audit? [unverified] If the LLM lives inside the vendor’s Command console, what exit clauses do you have if the Claude / ChatGPT / Gemini license contract changes? [unverified] And if California is asking for onsite independent verification of frontier AI, what part of your RFP requires the equivalent for the model running on your footage? [unverified]

( the “analytics service on the CCTV you already own” model — where the AI layer runs separate from the camera vendor’s console — survives all three vectors without contract rewrites: the 24-hour clock applies to the hardware manufacturer, not the analytics layer; the LLM can be swapped without touching the footage; and independent verification is structurally possible because the AI layer is not a vendor black box [unverified] )

P.D. Did your last enterprise CCTV RFP ask the vendor in writing: (a) how they comply with the CRA’s 24-hour clock, (b) what happens if their Claude / ChatGPT / Gemini integration changes price or license, and (c) what independent verification they accept on the AI layer running on your footage? [unverified] If the answer to any of those is “not in writing,” today is a good day to reopen the bid.

📰 Source: European Commission (Sep 11, 2026) + Skadden + Slaughter and May + Travers Smith (legal opinions) + SecurityInfoWatch + Verkada blog (VerkadaOne 2026) + California Governor’s Office + EFF + Politico (California EO N-9-26).

Sources

The CRA's 24-hour clock went live on September 11. If your enterprise camera sells in the EU, it already applies.

Sources

📰 Sources

Interested in video analytics on the cloud?