The CRA’s reporting clock is already running
Illustrative image: Dawid Kochman on Unsplash
The Cyber Resilience Act’s reporting requirements took effect on 11 September 2026. Manufacturers of products with digital elements covered by the EU regulation already face deadlines for reporting actively exploited vulnerabilities and severe security incidents.
This is an earlier obligation than the CRA’s broader December 2027 implementation milestone. ENISA’s guidance says it can also cover products placed on the market before that date. An existing product range is not automatically outside the reporting rules simply because it predates the main requirements.
Two events trigger the process
An actively exploited vulnerability is one for which there is reliable evidence of exploitation by a malicious actor. That is different from discovering a weakness that could potentially be exploited.
The second category is an incident with a severe impact on the security of a covered product. ENISA points to effects on availability, authenticity, integrity or confidentiality, with the severity criteria set out in Article 14 of the regulation.
The first deadline arrives before the final investigation
The European Commission sets out a staged process. An early warning must be submitted without undue delay and within 24 hours of awareness. A fuller notification follows within 72 hours of awareness.
The final-report deadlines then diverge. For an actively exploited vulnerability, the deadline is no later than 14 days after a corrective or mitigating measure becomes available. For a severe incident, it is within one month of the 72-hour notification.
These are not three interchangeable dates. The initial notification cannot wait for the final technical account or a completed patch rollout.
One platform, with a separate timetable for stewards
Mandatory submissions go through ENISA’s Single Reporting Platform. The notification reaches the relevant national Computer Security Incident Response Team and, except in specified exceptional circumstances, ENISA. The platform provides a single submission route rather than requiring separate filings to each national authority.
ENISA has published registration instructions, submission guidance and a user manual. Its current guidance says the initial platform has no reporting API, so internal automation does not remove the need to submit through the interface.
Open-source software stewards have a different start date: their corresponding reporting obligations apply from 11 December 2027. That distinction does not postpone a manufacturer’s existing duties where a covered product incorporates open-source software.
For an incident-response process, the immediate operational question is whether awareness can be recognised, escalated and reported within the first 24 hours, while investigation and remediation continue.
