Cyber Resilience Act: reporting is live, the rest follows in 2027

Published 19 October 2026 · By Dazr

Since 11 September 2026 manufacturers report exploited vulnerabilities and severe incidents to ENISA's platform. Full CRA rules apply on 11 December 2027.

The Cyber Resilience Act (Regulation (EU) 2024/2847) sets security rules for hardware and software sold in the EU. Its first obligation with real weight now applies, and the main requirements follow in just over a year.

What applies since 11 September 2026

Manufacturers of products with digital elements must report two kinds of events through ENISA's Single Reporting Platform, which ENISA launched on 11 September 2026:

Actively exploited vulnerabilities in their products: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days after a corrective or mitigating measure is available.
Severe incidents affecting the security of their products: an early warning within 24 hours, a notification within 72 hours, and a final report within one month after the notification.

A report goes to the CSIRT of the manufacturer's Member State, which acts as coordinator, and to ENISA at the same time. The manufacturer must also inform the users of the product, where needed with the measures they can take.

These duties cover products already on the market too, not only new ones (Article 69(3)). Micro and small manufacturers are covered as well; they cannot be fined for missing only the 24-hour early warning.

What comes next

11 December 2027: the CRA applies in full: security by design, vulnerability handling during the support period, technical documentation, conformity assessment and the CE marking. Reporting duties for open-source software stewards also start on that date.
Since 11 June 2026, the rules on notifying conformity assessment bodies have applied, so that notified bodies can be ready before 2027.

What to do now

Decide who in your organisation can file a report within 24 hours, including weekends, and test access to the platform.
Keep one record per event with the time you became aware, because every deadline counts from that moment.
Prepare a short text template for informing users.
Use the time until December 2027 for the design and documentation requirements: an inventory of products in scope, a software bill of materials and a vulnerability handling process.

Our guide explains Article 14 in more detail: Cyber Resilience Act reporting.

Sources

For information only, not legal advice. Last updated 19 October 2026.

Topics: Cyber Resilience Act, ENISA, EU

Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål