EU Cyber Resilience Act: First Reporting Obligations Take Effect Today

On 11 September 2026 the reporting obligations under the EU Cyber Resilience Act (“CRA”) will take effect. While the CRA's principal requirements and obligations will not apply until December 2027, from today manufacturers of in-scope products will need to report any vulnerabilities in their products which have been actively exploited and/or severe incidents impacting the security of that product. 

The Commission has also recently published guidance and a set of FAQs to help organisations comply with these obligations and the upcoming requirements under the CRA.  

Here we ask some key questions about the CRA and the reporting obligations that are coming into force. 

1. What does the CRA Cover?

The CRA establishes a regulatory framework for the cybersecurity requirements of “products with digital elements” that are placed on the EU market, “the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network”. The definition of ‘products with digital elements’ is broad covering “a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately”. As a result, it can cover a wide range of products, from consumer devices such as smart fridges through to mobile apps.

The CRA generally does not apply to medical devices, motor vehicles or airplanes (and related products) as these are subject to separate, existing, Regulations.

2. Who has obligations under the CRA?

The principal obligations under the CRA apply to manufacturers, who must carry out a cybersecurity assessment in relation to in-scope products with a view to minimising cyber risks and implementing specified essential cybersecurity requirements.

Importers and distributors are, however, also face some obligations. For example, importers must  ensure that in-scope products they place on the market comply with the essential cybersecurity requirements and distributors must  verify that the in-scope products bear the relevant CE marking. 

3. What must be reported from 11 September and when?

Under Article 14, manufacturers are required to report to the relevant authorities:

• any actively exploited vulnerability contained in their product with digital elements. A vulnerability is "actively exploited" where there is reliable evidence that a malicious actor has exploited it in a system without the permission of the system owner. As a result, vulnerabilities discovered as part of business-as-usual security testing for example, are not subject to mandatory notification unless there is evidence of exploitation; and
   
• any severe incident having an impact on the security of an in-scope product. An incident is considered "severe" where it (i) negatively affects or is capable of negatively affecting the product's ability to protect the availability, authenticity, integrity, or confidentiality of sensitive or important data or functions, or (ii) has led or is capable of leading to the introduction or execution of malicious code in the product or in the network and information systems of a user. This would, for example, include an attacker successfully introducing malicious code into the manufacturer's release channel for security updates.

Importantly, these reporting obligations apply to all products with digital elements within the scope of the CRA, including those placed on the market before December 2027. 

In terms of timings, the notification regime is staged. An early warning notice must be given within 24 hours of the manufacturer becoming aware and a more detailed notification must follow within 72 hours. A final report must then be delivered within 14 days of a corrective or mitigating measure becoming available for vulnerabilities, or within one month of the 72-hour notification where there has been a severe incident.

4. How do you make a report?

Each report made pursuant to Article 14 shall be made simultaneously to ENISA and the coordinating national computer security incident response teams via ENISA's Single Reporting Platform (the “SRP”). The SRP launched today (11 September) to coincide with the reporting obligations coming into effect. ENISA has also published detailed guidance on the registration and notification submission steps, and explained the information required at each reporting stage (see ENISA’s FAQs).

5. Do manufacturers also have to inform users?

Article 14 imposes a separate obligation on manufacturers to inform impacted users (and, where appropriate, all users) of any actively exploited vulnerability or severe incident, together with any risk mitigation or corrective measures that users can deploy. The Guidance clarifies that the obligation to inform all users is to be applied in a risk-based and proportionate manner - disclosure does not need to be public or indiscriminate. For instance, where the product is used in sensitive environments, manufacturers may limit detailed information to the affected users or customers concerned, particularly where broader disclosure of technical details could itself increase cybersecurity risks or facilitate further exploitation. Once the vulnerability has been adequately addressed or mitigated, broader disclosure may become appropriate.

6. What fines can manufacturers face for non-compliance?

Failure to comply with the mandatory reporting requirements under Article 14 can give rise to fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher (subject to certain exemptions for microenterprises and small enterprises). There is also no GDPR style ‘one stop shop’ and so enforcement and fining is managed at Member State level. This means manufacturers could face multiple enforcement actions, although there are some processes for Member States to coordinate steps taken. 

7. What does this mean in practice for manufacturers and customers?

While much of the focus on the CRA has understandably been on preparing for full compliance by December 2027, the reporting obligations bring a more immediate operational challenge. 

Manufacturers should ensure that existing incident response processes enable potential CRA events to be identified and escalated quickly enough to meet the 24-hour deadline, with clear responsibility for deciding whether the reporting threshold is met, making the necessary notifications and coordinating communications with users. They should also consider how CRA reporting fits with notification obligations under other cyber, data and sector-specific regimes. 

For customers, CRA readiness and (now) compliance is increasingly relevant to technology procurement and supply-chain diligence: understanding whether a supplier has identified its in-scope products, established appropriate vulnerability and incident reporting processes and allocated responsibility for compliance can provide a useful indication of its wider approach to cyber risk in its products. Contractual arrangements may also need revisiting (if, for example, customers want to agree when manufacturers need to provide them with details of any relevant vulnerabilities or incidents).