What changed: From 11 September 2026, Article 14 of the EU Cyber Resilience Act applies [1][2]. Manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe incidents affecting their products' security [1]. The rest of the CRA’s main obligations apply from 11 December 2027 [1].
Who it applies to
- Manufacturers of products with digital elements within the CRA’s scope, including non-EU manufacturers whose products are on the EU market [1].
- Older products too. The reporting obligation covers in-scope products placed on the market before 11 December 2027, not just new ones [1].
What must be reported, and when
| Actively exploited vulnerability | Severe incident affecting product security | |
|---|---|---|
| Early warning | Within 24 hours of becoming aware [1] | Within 24 hours of becoming aware, including whether it’s suspected to be caused by unlawful or malicious acts [1] |
| Notification | Within 72 hours of becoming aware [1] | Within 72 hours of becoming aware [1] |
| Final report | No later than 14 days after a corrective or mitigating measure is available [1] | Within one month after the incident notification [1] |
Manufacturers notify simultaneously to the CSIRT designated as coordinator and to ENISA, via the single reporting platform [1][3]. Manufacturers must also inform impacted users and, where appropriate, all users, including mitigation measures where necessary [1].
The Single Reporting Platform
ENISA operates the Single Reporting Platform (SRP). Its page lists the CSIRTs designated as coordinators and notes an upgrade to SRP version 1.3 on 4 November 2026 [3]. Check ENISA’s page for current registration and submission guidance before you need it.
What to do now
- Confirm which of your products are in scope, including products already in the field.
- Agree internally who decides whether a vulnerability is "actively exploited" and who submits reports.
- Register for the SRP and test access before the first real report.
- Map the 24h/72h/14-day clock into your vulnerability process. Our guide to setting up a PSIRT covers roles and triage, and the Cyber Resilience Act reporting workflow will go step by step.
For the wider picture, see our Cyber Resilience Act guide.
Sources
All accessed 2026-11-10.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024. Cited: Art. 2, 14(1)–(4), 14(7)–(8), 69(3), 71(2). EUR-Lex, ELI: http://data.europa.eu/eli/reg/2024/2847/oj
- European Commission, "Cyber Resilience Act" policy page (last update 7 September 2026). https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
- ENISA, "Single Reporting Platform (SRP)". https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp
Spotted an error? Report it to our corrections log. Read our editorial methodology.