Preparing for the EU Cyber Resilience Act: Key Reporting Obligations From 11 September 2026

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, adopted on 23 October 2024, aims to strengthen the cybersecurity of “products with digital elements”. The CRA applies to hardware and software products made available on the EU market whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network.

The legislation responds to the growing number of cyberattacks targeting hardware and software, many of which contain vulnerabilities that are not adequately addressed through cybersecurity measures or timely security updates. Its main objectives are to ensure that products with digital elements are secure by design and remain resilient against cyber threats throughout their life cycle, while providing users with clear information that enables them to consider cybersecurity when selecting and using products.

The CRA delivers some harmonisation of EU member state laws, but there is mainly a shift towards new substantive obligations, specifically higher regulatory expectations for product security. Previously, EU cybersecurity requirements for products were fragmented across member states. The CRA therefore introduces a single harmonised framework across the EU.

What Are the Obligations? 

For products placed on the EU market on or after 11 December 2027, or products placed on the market before that date which subsequently undergo a “substantial modification”, the CRA’s broader obligations will apply. However, certain reporting obligations will apply earlier, from 11 September 2026 (see further below).

Under the CRA’s broader obligations, manufacturers will be required to assess cybersecurity risks, design and develop products in accordance with the CRA’s essential cybersecurity requirements, address vulnerabilities, and provide security updates throughout the applicable support period. They must also prepare technical documentation, complete the appropriate conformity assessment, issue an EU declaration of conformity, provide prescribed information to users, and affix the CE marking. Importers and distributors will have corresponding obligations to verify compliance before making products available on the EU market.

A separate, lighter-touch regime applies to “open-source software stewards”: legal persons that systematically and sustainably support the development of free and open-source software intended for commercial activities and play a main role in ensuring its viability. From 11 December 2027, stewards must, among other things, establish and document a cybersecurity policy that promotes secure development and effective vulnerability management and cooperate with market-surveillance authorities. The corresponding reporting obligations for open-source software stewards will apply from 11 December 2027.

However, where free and open-source software is placed on the market in the course of a commercial activity, the company responsible may instead qualify as a manufacturer and become subject to the full manufacturer obligations.

What Needs To Be Reported? 

Although the majority of the CRA’s requirements become mandatory from 11 December 2027, its reporting obligations take effect on 11 September 2026. The reporting obligation applies to all products with digital elements within the scope of the CRA, including products placed on the EU market before 11 December 2027. From this date, manufacturers are required to notify their national Computer Security Incident Response Team (CSIRT), the national body responsible for receiving and coordinating reports about cybersecurity vulnerabilities and incidents, of the following events affecting the security of the product:

1. An actively exploited vulnerability: a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without the system owner’s permission. A vulnerability discovered through good-faith research, testing, or disclosure is not subject to mandatory reporting unless there is evidence of malicious exploitation.
2. A severe incident: an incident that negatively affects, or could negatively affect, the product’s ability to protect the availability, authenticity, integrity, or confidentiality of sensitive or important data or functions. An incident is also considered severe where it has led, or could lead, to malicious code being introduced or executed in the product or in a user’s network and information systems.

The obligation to report is triggered when the manufacturer becomes aware of an actively exploited vulnerability or severe incident. Importantly, the obligation is not retrospective. A manufacturer does not need to report an event if it was already aware of the active exploitation or incident before 11 September 2026. However, the obligation will apply if the manufacturer becomes aware on or after that date, even where the vulnerability or affected product already existed.

Manufacturers should also be aware that the reporting duty can extend to vulnerabilities originating in components made by third parties. If a vulnerability in an integrated component is actively exploited in the manufacturer’s product, the product manufacturer must notify the relevant national CSIRT accordingly. The manufacturer of the component will also have a separate reporting obligation where the component was itself placed on the market.

A notification under the CRA should not be assumed to satisfy any separate reporting obligations arising from the same event. Depending on the circumstances, the manufacturer may also need to submit a separate notification under the EU General Data Protection Regulation, Network and Information Systems Directive No. 2, or other applicable cybersecurity and sector-specific legislation.

How to Report and When?

The notification timetable is staged, so that an early warning can be made as soon as possible, while still providing for a full investigation to follow. The manufacturer must adhere to the following timetable:

• An initial notification within 24 hours: The manufacturer must submit an early warning. This should identify the affected product and, where applicable, the member state in which it has been made available. For a severe incident, the manufacturer must also state whether it suspects that the incident was caused by unlawful or malicious activity.
• A follow-up within 72 hours: The manufacturer must submit a more detailed notification, including the available information about the vulnerability or incident, the product affected, an initial assessment of the impact, and any measures taken or available to address the issue or reduce the risk to users.
• Final report: 
  • Within 14 days for an actively exploited vulnerability. The final report must be submitted no later than 14 days after a security update or other corrective or risk-reduction measure becomes available. The report must describe the vulnerability, information on the malicious actor, and details of the security update or other measures taken to address the vulnerability. 
  • Within one month of the 72-hour notification for a severe incident. The report must describe the incident, its severity and impact, the type of threat or likely root cause, and the measures taken or continuing to reduce its impact.

Notifications must be submitted using ENISA’s Single Reporting Platform. Each notification is addressed to the relevant national CSIRT and is made available simultaneously to ENISA. Manufacturers are responsible for identifying the correct CSIRT through the Single Reporting Platform (SRP), which will be the CSIRT in the EU member state of the manufacturer’s main establishment.

Where a product is sold or used in several member states, the manufacturer does not need to submit a separate report in each country. It should report to the national CSIRT in the country where it principally makes decisions about the cybersecurity of its products. If that country cannot be identified, the manufacturer should generally report in the EU country where it has the establishment with the highest number of employees.

Different rules apply where the manufacturer has no establishment in the EU. In that situation, the CRA prescribes a hierarchy based on the location of the manufacturer’s authorised representative, importer, distributor, and, ultimately, users.

Manufacturers must also inform affected users about the vulnerability or incident without undue delay. Where necessary, they should explain the steps users can take to protect themselves, such as installing a security update, changing a setting, or temporarily limiting use of the product.

ENISA has published FAQs with respect to the SRP. 

What Are the Consequences for Not Complying? 

From 11 September 2026, a breach of the CRA’s reporting obligations may attract an administrative fine of up to €15 million or, for an undertaking, 2.5% of its total worldwide annual turnover for the preceding financial year, whichever is higher. From 11 December 2027, the same maximum penalty will also apply to non-compliance with the CRA’s essential cybersecurity requirements and other manufacturer obligations. member states will establish the applicable enforcement arrangements, and the amount of any fine will depend on factors such as the nature, seriousness, and duration of the breach and its consequences.

What To Do Next

Companies need to begin preparing now by identifying the products with digital elements they make available on the EU market and determining whether they act as a manufacturer, importer, distributor, or open-source software steward. Manufacturers will need to prioritise establishing procedures to identify and report actively exploited vulnerabilities and severe security incidents when the reporting obligations take effect on 11 September 2026. Wider readiness measures should include carrying out cybersecurity risk assessments, reviewing product-development and vulnerability-management processes, determining appropriate support periods, preparing technical documentation and software bills of materials, and identifying the applicable conformity-assessment route. Companies will also need to review contracts and responsibilities across their supply chains and assess whether existing products are likely to undergo substantial modification after 11 December 2027.

We would like to thank Claudia Baldelli for their assistance with this alert.