Cyber Resilience Act Reporting: What Manufacturers Must Report Since 11 September 2026

The timeline

The Cyber Resilience Act (Regulation (EU) 2024/2847, the CRA) sets cybersecurity requirements for products with digital elements. Under Article 71(2), it applies from 11 December 2027, but Article 14, the reporting obligations, applies from 11 September 2026, and the rules on conformity assessment bodies (Chapter IV) from 11 June 2026.

One detail matters for existing products: under Article 69(3), the Article 14 obligations apply to all products in scope that were placed on the market before 11 December 2027. Products you already sell are covered now, even though the rest of the CRA does not yet apply to them.

Who must report

The duty sits with the manufacturer: anyone who develops or manufactures products with digital elements, or has them designed or manufactured, and markets them under its own name or trademark, whether for payment or free of charge (Article 3(13)). A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately (Article 3(1)), with a data connection to a device or network (Article 2(1)).

Some products are excluded because other EU rules cover them, such as medical and in vitro diagnostic devices, type-approved vehicles, certified aviation products and marine equipment (Article 2(2) to (4)).

What must be reported

Event	Definition	Article
Actively exploited vulnerability	A vulnerability in your product for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission	14(1), 3(42)
Severe incident having an impact on the security of the product	An incident that affects, or can affect, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or that has led or can lead to malicious code in the product or in a user's systems	14(3), 14(5)

The deadlines

Both clocks start when the manufacturer becomes aware of the vulnerability or incident:

Report	Actively exploited vulnerability	Severe incident
Early warning	Within 24 hours, indicating the member states where the product has been made available, as far as you know	Within 24 hours, including whether it is suspected to be caused by unlawful or malicious acts, and the member states concerned
Notification	Within 72 hours: the product, the general nature of the exploit and vulnerability, corrective or mitigating measures taken and those users can take, and how sensitive you consider the information	Within 72 hours: the nature of the incident, an initial assessment, corrective or mitigating measures taken and those users can take
Intermediate report	On request of the CSIRT	On request of the CSIRT
Final report	No later than 14 days after a corrective or mitigating measure is available: description and severity, any information on the malicious actor, details of the security update	Within one month after the incident notification: detailed description, root cause, applied and ongoing mitigation

Where the information has already been provided in an earlier report, you do not need to repeat it (Article 14(2) and (4)).

Where reports go

Reports are submitted through the single reporting platform established by ENISA (Article 16), using the electronic notification end-point of the CSIRT designated as coordinator in the member state of your main establishment in the EU, and are simultaneously accessible to ENISA (Article 14(7)). Your main establishment is where decisions on your products' cybersecurity are predominantly taken; if that cannot be determined, the establishment with the most employees in the EU.

Manufacturers without an establishment in the EU use, in this order, the member state of the authorised representative acting for most of their products, then of the importer, then of the distributor, and finally the member state with the most users of their products.

Telling your users

After becoming aware of an actively exploited vulnerability or a severe incident, you must also inform the impacted users, and where appropriate all users, and tell them about mitigation and corrective measures they can deploy, where appropriate in a structured, machine-readable format (Article 14(8)). If you do not do this in time, the CSIRT may inform users itself.

Getting ready

List the products you have placed on the EU market that fall within scope, including older versions still in use.
Set up intake for vulnerability reports and threat intelligence, so evidence of active exploitation reaches the right people fast.
Decide who confirms "reliable evidence" of exploitation and who classifies an incident as severe, and record when you became aware.
Identify your coordinating CSIRT and register for the single reporting platform before you need it.
Prepare templates for the early warning, the notification and the final report, and for the user advisory.
Rehearse it: run a tabletop exercise on an exploited vulnerability in one of your products.

Already under NIS2 or GDPR? these duties run in parallel. A product incident can also be a significant incident under NIS2 or a personal data breach under GDPR, each with its own report. See our NIS2 incident reporting and GDPR breach notification guides.

Rehearse before it is real. The Incident Response Playbook includes a master incident response plan, six scenario playbooks, regulatory notification templates and tabletop exercise scenarios you can adapt to CRA reporting.

Sources

Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 2, 3, 14, 16, 69 and 71, EUR-Lex