Cyber Resilience Act: how to report vulnerabilities within 24 hours

Since 11 September 2026, manufacturers of any product with digital elements sold in the European Union have a new and very specific obligation: to report actively exploited vulnerabilities within 24 hours. It is the first part of the Cyber Resilience Act (Regulation (EU) 2024/2847) to really apply, and it has arrived before the rest of the regulation, which will not be fully applicable until December 2027.

Many people still think the CRA is “for next year”. For reporting, it is not. It already applies.

The Cyber Resilience Act in two paragraphs

The CRA sets mandatory cybersecurity requirements for products with digital elements: hardware and software that connect, directly or indirectly, to another device or to a network. From an IP camera to on-premises management software. It requires security by design, vulnerability handling throughout the support period and technical documentation, with the CE marking as proof of compliance.

The difference from NIS2 is key. NIS2 regulates the entities that provide essential or important services. The CRA regulates the products those entities, and everyone else, buy and use. They are complementary.

What must be reported from September 2026

Article 14 requires the manufacturer to report two kinds of events:

• Actively exploited vulnerabilities in its products, that is, those for which there is reliable evidence that someone is exploiting them.
• Severe incidents affecting the security of the product.

And a detail many overlook: under Article 69(3), this obligation applies to all products within the scope of the regulation, including those placed on the market before 11 December 2027. There is no exception for what is already on the market.

The deadlines: 24 hours, 72 hours and the final report

• Early warning within 24 hours of the manufacturer becoming aware.
• Full notification within 72 hours, with the available information on the vulnerability or incident and the measures taken.
• Final report: for vulnerabilities, no later than 14 days after a corrective measure is available; for severe incidents, within one month of the 72-hour notification.

Notifications are submitted through the Single Reporting Platform run by ENISA, addressed to the coordinating CSIRT of the relevant Member State, with ENISA receiving the information simultaneously.

If these deadlines sound familiar, it is because they closely resemble those of NIS2 and DORA. I compared them in detail in the article on 72-hour incident reporting under GDPR, NIS2 and DORA. The difference is that here the product manufacturer reports, not necessarily the entity that suffers the incident.

Who is affected (and who thinks they are not)

Obviously, manufacturers of devices and commercial software. But also:

• Companies that develop their own software and sell or distribute it to customers, even if they do not see themselves as “software companies”.
• Importers and distributors, who have verification and information obligations.
• Anyone who substantially modifies a product and puts it back on the market, who is then considered a manufacturer.

And for organisations that buy technology, the CRA is a supplier management tool: you can and should require your manufacturers to show how they comply. It fits squarely with the supplier assessment NIS2 requires across the supply chain.

Penalties

Non-compliance with the essential requirements and the obligations in Articles 13 and 14 can be fined up to 15 million euros or, if higher, up to 2.5% of total worldwide annual turnover. Not a figure to take lightly.

How to prepare in practice

1. Inventory of affected products. Which products with digital elements you place on the market, in which versions and with what support period.
2. A vulnerability intake channel. A coordinated disclosure policy and a mailbox someone actually reads, weekends included.
3. A 24/7 triage procedure. Who decides whether a vulnerability is “actively exploited” and how quickly. The clock starts when you become aware, not when you are one hundred percent sure.
4. Access to the ENISA platform and notification templates ready before you need them.
5. Patch management and SBOM. Knowing which components each product contains is essential to react fast. I cover this in patch and vulnerability management and in how to build security into the secure development life cycle.
6. An exercise. Run the full cycle at least once: detection, triage, 24-hour warning, 72-hour notification and final report.

What comes next

The CRA timeline continues: the rules on notified bodies have applied since June 2026 and the regulation becomes fully applicable on 11 December 2027, when all new products must meet the essential requirements to bear the CE marking. Those developing AI-enabled products will also have to coordinate the CRA assessment with the AI Act one, which follows a logic similar to the conformity assessment of high-risk AI systems.

Conclusion: the clock is already ticking

The Cyber Resilience Act does not start in 2027. Its most time-critical obligation, 24-hour reporting, is already active and affects products that have been on the market for years. The good news is that preparing does not require large investments, but process, clear owners and practice.

If your organisation manufactures or integrates products with digital elements and needs to organise its CRA compliance alongside NIS2 or DORA, I can help you lead it. Let’s talk.

Frequently asked questions about the Cyber Resilience Act