The European Union is moving into a new phase of cybersecurity regulation as the Cyber Resilience Act (CRA) begins applying its mandatory vulnerability and incident reporting requirements on 11 September 2026.
From that date, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents affecting their products through the EU's new Cyber Resilience Act Single Reporting Platform (SRP).
The first warning must be submitted without undue delay and no later than 24 hours after the manufacturer becomes aware of the issue. A more detailed notification follows within 72 hours.
This changes the operational reality for product manufacturers: vulnerability management is no longer only a technical or product-security function. It becomes a regulatory reporting responsibility with potentially significant financial consequences.
What is the Cyber Resilience Act?
The CRA is the EU's legislation establishing cybersecurity requirements for products with digital elements.
Its scope is broad. It covers products that connect directly or indirectly to a device or network, ranging from software and applications to connected hardware and other digital products.
The regulation introduces cybersecurity requirements throughout the product lifecycle, including vulnerability handling, security documentation, support periods and incident reporting.
While the CRA entered into force in December 2024, its requirements are being introduced in stages. The mandatory reporting obligations under Article 14 apply from 11 September 2026, while the CRA becomes fully applicable on 11 December 2027.
The 24-hour clock starts on 11 September
The most immediate change for manufacturers is the introduction of mandatory reporting for two categories of events:
- Actively exploited vulnerabilities
- Severe incidents affecting the security of a product with digital elements
An actively exploited vulnerability means there is reliable evidence that a malicious actor has exploited the vulnerability without authorization.
A severe incident is an incident that negatively affects, or is capable of negatively affecting, the ability of a product to protect the availability, authenticity, integrity or confidentiality of data or functions.
Once the manufacturer becomes aware of such an event, the reporting process begins.
The CRA reporting timeline
- Within 24 hours:
An early warning must be submitted.
- Within 72 hours:
The manufacturer must provide a more complete notification containing general information and an initial assessment.
- For actively exploited vulnerabilities:
A final report is required no later than 14 days after a corrective measure becomes available.
- For severe incidents:
The final report is due within one month of the 72-hour notification.
This means the 24-hour deadline is not the complete reporting requirement. It is the beginning of a structured reporting process.
ENISA's Single Reporting Platform
To avoid forcing manufacturers to submit the same information separately to multiple European authorities, the CRA introduces a Single Reporting Platform operated by ENISA, the European Union Agency for Cybersecurity.
Manufacturers submit one notification through the platform and select the relevant national CSIRT acting as coordinator.
The notification is simultaneously made available to ENISA, while the coordinating CSIRT can distribute it to other relevant CSIRTs in EU Member States where the product is available.
The platform is scheduled to become operational on 11 September 2026, the same day the mandatory reporting requirements begin. ENISA says functional and security testing is underway.
This creates an unusual operational challenge for manufacturers: the regulatory reporting deadline and the production launch of the reporting infrastructure arrive essentially together.
What information needs to be prepared?
Manufacturers should not wait until an incident occurs to determine who is responsible for submitting a CRA notification.
The ENISA reporting process already defines fields covering information such as:
- The affected product
- The vulnerability or incident
- CVE or EUVD identifiers where applicable
- Exploitation information
- Severity and impact
- The suspected malicious actor, where known
- The general nature of the exploit
- Mitigation measures
- The likely root cause of an incident
- Exceptional circumstances that may justify delayed dissemination
Not every piece of information is required at the 24-hour stage. Some fields become necessary during the 72-hour notification or final report.
This is important because the regulation does not require manufacturers to have a complete forensic investigation finished within 24 hours.
It requires them to recognize a reportable event and initiate the reporting process quickly.
What about vulnerabilities that are not being exploited?
The CRA reporting requirement is specifically focused on actively exploited vulnerabilities and severe incidents.
A vulnerability that has been discovered internally but has no reliable evidence of exploitation does not automatically trigger the mandatory 24-hour Article 14 notification.
ENISA's platform will eventually support voluntary reporting of other vulnerabilities, cyber threats, incidents and near misses, but the mandatory functionality launching on 11 September is focused on the reportable categories defined by the CRA.
That distinction will be important for security teams because not every newly discovered CVE becomes a CRA report.
The rules also matter to non-EU manufacturers
One of the biggest misconceptions about the CRA is that it only concerns European companies.
The obligations apply to products with digital elements made available on the EU market. The Commission's guidance makes clear that reporting obligations can also apply to products already placed on the market before the CRA's broader requirements become applicable in December 2027.
For international manufacturers, this means the EU reporting process needs to be integrated into their global vulnerability-management and incident-response procedures.
A company headquartered outside Europe may still need to determine:
Does this product fall within the CRA?
Where is the manufacturer's main establishment?
Who is responsible for the CRA notification?
Who can submit the report within 24 hours?
How will legal, product security, engineering and communications teams coordinate?
These questions should already have clear answers.
The financial risk is significant
The CRA provides for administrative fines for certain violations.
For non-compliance with essential cybersecurity requirements and obligations under Articles 13 and 14, penalties can reach €15 million or 2.5% of a company's total worldwide annual turnover from the preceding financial year, whichever is higher.
The exact penalty applied will depend on the circumstances and national enforcement arrangements. Member States are responsible for establishing and implementing the applicable penalty rules.
There are also specific provisions concerning smaller companies. For example, the CRA provides an exception from certain administrative fines for microenterprises and small enterprises that miss the Article 14 early-warning deadline.
The important point for larger manufacturers is that CRA compliance is not simply a documentation exercise. Failure to meet the regulation's requirements can have substantial financial consequences.
The bigger challenge: detecting an incident fast enough
The 24-hour deadline creates an operational problem that cannot be solved by the legal department alone.
Consider a typical vulnerability scenario:
A security researcher reports a critical vulnerability.
The product security team begins investigating.
A few hours later, threat intelligence indicates exploitation.
Engineering starts reproducing the attack.
The incident response team investigates whether customers were affected.
Legal and compliance teams assess regulatory obligations.
Management wants to understand the potential impact.
At the same time, the CRA clock is already running.
The organization therefore needs a mechanism that connects threat intelligence, vulnerability management, incident response, product security and regulatory reporting.
Without that connection, valuable hours can disappear while different teams try to establish who is responsible.
What manufacturers should do now
Organizations affected by the CRA should treat the September deadline as an operational readiness milestone.
1. Identify products covered by the CRA
Build a clear inventory of products with digital elements placed on the EU market.
Include software, connected devices, embedded components and relevant third-party dependencies.
2. Define the reporting owner
There should be a named person or team responsible for initiating a CRA notification.
Do not rely on an informal assumption that "security will handle it."
3. Establish a 24-hour escalation process
Create a specific escalation path for suspected actively exploited vulnerabilities and severe incidents.
Security teams should know exactly when an event becomes a potential CRA-reportable event.
4. Prepare the required information in advance
Maintain product identifiers, support contacts, vulnerability-management information and other data that may be required by the SRP.
This reduces the amount of information that has to be collected during an active incident.
5. Test the process
Run a tabletop exercise based on a realistic scenario:
"A critical vulnerability in one of our products is confirmed as actively exploited at 09:00."
Then determine whether the organization can identify, assess, approve and submit the initial notification within 24 hours.
6. Integrate CRA reporting into incident response
CRA reporting should not exist as a separate compliance workflow.
It should become part of the organization's existing vulnerability disclosure and incident-response process.
7. Register and prepare access
ENISA has published guidance for Assigned Representatives, including registration and notification-submission procedures. Manufacturers should establish the appropriate users and responsibilities before the reporting obligation becomes operational.
A new era for product security
The CRA represents a significant change in how cybersecurity responsibilities are distributed across the technology industry.
Security vulnerabilities are no longer purely an engineering problem. For manufacturers selling digital products in Europe, vulnerability discovery, exploitation monitoring, incident response and regulatory reporting are becoming interconnected responsibilities.
The 24-hour rule is particularly important because it forces organizations to think about their ability to detect and classify security events quickly, not simply their ability to patch them.
The companies that are best prepared will not necessarily be those with the largest security teams. They will be the ones with the clearest processes, ownership, visibility and automation.
Final thoughts
September 11, 2026 is an important milestone for manufacturers selling connected and software-enabled products in the European market.
From that date, the CRA's mandatory reporting mechanism becomes operational, with a 24-hour early-warning requirement, a 72-hour notification, and subsequent reporting obligations.
The most important preparation is therefore not simply registering for the ENISA platform.
Under the CRA, vulnerability management is becoming a regulatory process as well as a cybersecurity process. Organizations need the people, technology and procedures to detect, assess and report serious product-security events before the 24-hour clock runs out.
