The EU Cyber Resilience Act faces mounting implementation challenges involving cybersecurity standards, vulnerability reporting, regulatory overlap and fundamental rights. The author argues that its expansive obligations risk undermining the regulation’s effectiveness and enforceability.