CRA reporting starts: early warning within 24 hours

The clock is ticking: manufacturers discovering an actively exploited vulnerability in their product or learning of a serious incident have little time.

Related: What is the CRA? Obligations for digital products  ·  The Cyber Resilience Act also covers your existing products

Manufacturers must proactively report product security issues

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, has been in force since 10 December 2024. Its main product obligations apply from 11 December 2027. The Commission’s information page on reporting obligations, dated 31 July 2026, describes the same start date and chain of recipients.

What are the CRA reporting obligations? Article 14 of Regulation (EU) 2024/2847 requires manufacturers, from 11 September 2026, to report actively exploited vulnerabilities and serious incidents through the CRA Single Reporting Platform, with an early warning within 24 hours and full notification within 72 hours.

Article 14 applies from 11 September 2026. Manufacturers must proactively report exploited vulnerabilities and serious security incidents. This covers vulnerabilities and incidents affecting the security of their products with digital elements.

The obligation rests with the manufacturer and is tied to the product with digital elements. Software companies and hardware vendors have the same reporting responsibilities whenever such a product is affected. An internal IT incident unrelated to such a product falls outside Article 14.

The trigger is awareness within the company. A public advisory can establish that point. An available update belongs to a later stage and triggers the final reporting deadline once a fix or mitigation is available.

Two deadlines start with awareness, the third comes later

Article 14 establishes three reporting stages for exploited vulnerabilities. Awareness triggers the first two: early warning and full notification. The third, the final report, is triggered only when a fix or mitigation becomes available. For serious incidents, it is due within one month of notification instead.

The early warning must be submitted without undue delay, and in any event within 24 hours of awareness. It identifies the Member States where the product is known to be available. Without this geographical overview, the warning is incomplete.

Full notification follows within 72 hours of awareness. It includes general information about the product, the nature of the exploit and vulnerability, measures taken and measures available to users. The manufacturer indicates how sensitive it considers the information.

For exploited vulnerabilities, the final report is due no later than 14 days after a corrective or mitigating measure becomes available. It describes the vulnerability, including its severity and impact. Where possible, it also provides information about attackers and details of the security update or corrective measures.

One submission, then onward sharing

The notification is submitted once through the CRA Single Reporting Platform. It goes to the CSIRT responsible for the main establishment in the Union: where most cybersecurity decisions are taken, or otherwise the establishment with the most employees. The platform combines submission to the CSIRT and ENISA.

ENISA receives the information simultaneously, except in specific exceptional cases. The receiving CSIRT immediately shares the notification with all other CSIRTs in whose territories the product is available. The manufacturer makes no second submission; onward sharing is the receiving CSIRT’s responsibility.

In exceptional cases, the receiving CSIRT may defer sharing on justified cybersecurity grounds. A Commission delegated act addressing this was adopted on 11 December 2025 and establishes deferral as an exception. The exception to simultaneous notification of ENISA and the exception to sharing with other CSIRTs are separate provisions.

Article 16 tasks ENISA with building the platform. A public tender has been awarded, and functional and security testing is underway. The platform is scheduled to become operational on 11 September 2026, the day the obligation takes effect.

Three weeks to establish headquarters, markets and roles

Companies still treating the Cyber Resilience Act as a project for 2027 are missing the first deadline already approaching. The start date falls just weeks after this analysis is published. A company without a designated main establishment, country list or awareness procedure starts with an incomplete reporting process.

First, the company must identify its main establishment in the Union and the corresponding coordinating CSIRT. It also needs an up-to-date list of Member States where the product is available. This list informs the early warning and subsequent sharing across the CSIRT network. It must be ready before the first real incident.

Companies also often lack an internal rule defining when awareness begins. Which role establishes that moment and which channel counts must be settled before the first real incident. Information sensitivity and measures available to users belong in a prepared template.

A company that waits until reporting day to resolve access and responsibilities spends its first reporting window setting up access.

The platform uses EU Login for access. According to ENISA, a Single Reporting Platform account is created only when an actual notification is submitted; the platform’s public address has yet to be determined. Rehearsing the process now means knowing your access arrangements before the first deadline starts ticking.

Article 14 applies before the product obligations

Internal incident response and vulnerability handling remain the operational backbone. From the start date, they need a reporting route to the Single Reporting Platform. Reporting to authorities becomes a separate track alongside existing response plans. The internal team sees the incident first; the platform receives the notification afterwards.

The reporting obligation under Article 14 does not wait for the 2027 product obligations; both sets of requirements belong to the same regulation. An implementation plan targeting December 2027 covers the later requirements. The earlier requirements concern reporting exploited vulnerabilities and serious incidents.

On 27 July 2026, the Commission published practical guidance to help manufacturers of all sizes implement the requirements. ENISA’s Single Reporting Platform FAQ provides further information. Section 9.1 of the Commission guidance and Section 5 of the implementation FAQ further clarify the reporting obligations.

The difficult part is the product’s geographical reach. A notification reaching the CSIRT responsible for the headquarters is forwarded to every CSIRT in whose territory the product is available. The sensitivity assessment and justified grounds for deferral belong in the same process and cannot wait for later revision.

Frequently asked questions

Each question is locked. Tap to unlock the answer.

Do the obligations also apply to open source?

The Commission gives free open-source projects special treatment without granting a blanket exemption. Anyone incorporating open-source components into a product with digital elements and acting as its manufacturer remains subject to the reporting obligation. The available guidance provides no blanket exemption for every publicly maintained project.

What if my company has several EU locations?

The coordinating CSIRT is determined by the main establishment in the Union. The early warning also identifies the Member States where the product is known to be available. The receiving CSIRT forwards the notification to the CSIRTs responsible for those territories.

When is an incident considered serious?

The regulation ties the obligation to incidents affecting the security of a product with digital elements. The available guidance provides no operational list of thresholds. It does clearly distinguish serious incidents from exploited vulnerabilities: for serious incidents, the final report is due within one month.

What changes on 11 December 2027?

The Cyber Resilience Act’s main product obligations then apply. Products placed on the market before that date are covered only if substantially modified; they have already been subject to Article 14 reporting obligations since 11 September 2026. The CRA itself has been in force since 10 December 2024.

Do I need to do anything as a user?

Article 14 makes reporting the manufacturer’s responsibility. It creates no separate obligation for users to report to CSIRTs or ENISA. The manufacturer’s full notification identifies measures available to users; these provide the practical starting point for users.

Editor’s Picks

▣Editor’s PickWhat Is the CRA? Obligations for Digital Products▣Editor’s PickThe Cyber Resilience Act Also Affects Your Installed Base▣Editor’s PickNIS2 Enforcement 2026: BSI Audit Phase and DACH Checklist

More from the MBF Media Network

▣cloudmagazinEU AI Act: a delay does not remove responsibilities▣MyBusinessFutureManufacturers Report CRA Incidents to ENISA Ahead of the CSIRT▣Digital ChiefsAI Act from 2 August: Transparency Before High Risk

Image source: AI-generated (August 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.