CRA reporting obligation applies since 11 September 2026
Since 11 September 2026, Article 14 of the Cyber Resilience Act (CRA) applies. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents within 24 hours, including for products that have been on the market for years.
What applies since 11 September 2026
The CRA entered into force on 10 December 2024 and applies in stages. Most obligations, such as the essential security requirements and CE marking, only apply from 11 December 2027. The reporting obligations of Article 14, however, have applied since 11 September 2026 (Art. 71(2)).
Important: the reporting obligation covers all products in scope, including those placed on the market before 11 December 2027 (Art. 69(3)). Older firmware, desktop software from 2019 or a device that is still sold or used are not exempt.
Who has to report
| Role | Obligation |
|---|---|
| Manufacturers of hardware or software with a data connection, whether based inside or outside the EU | Full reporting obligation under Art. 14 |
| Importers or distributors that place a product on the market under their own name or trademark, or substantially modify it (Art. 21) | Treated as manufacturer, full reporting obligation |
| Any other person who substantially modifies a product and makes it available on the market (Art. 22) | Treated as manufacturer, full reporting obligation |
| Other importers or distributors | No report to ENISA of their own, but must inform the manufacturer without undue delay, and the market surveillance authorities if there is a significant cybersecurity risk (Art. 19, 20) |
| Open-source software stewards (e.g. a foundation) | Limited: vulnerabilities to the extent they are involved in development; incidents to the extent they affect systems they provide for development (Art. 24(3)). No fines apply to them (Art. 64(10)) |
Micro and small enterprises must report as well. Art. 64(10) provides some relief: fines are not meant to apply to them for missing the 24-hour early warning deadline. However, the wording refers to paragraphs 3 to 9, while infringements of Art. 14 are covered by paragraph 2, so the exact reach of this exemption is not settled. The 72-hour notification and the final report are not covered by the relief in any case.
Who is not affected
- Products covered by their own EU rules: medical and in vitro diagnostic devices (MDR, IVDR) and vehicles under Regulation (EU) 2019/2144 (Art. 2(2)), aviation products certified under Regulation (EU) 2018/1139 (Art. 2(3)) and marine equipment (Art. 2(4))
- Products developed or modified exclusively for national security or defence purposes, and products specifically designed to process classified information (Art. 2(7))
- Spare parts that replace identical components built to the same specifications (Art. 2(6))
- Pure software as a service, unless it is a remote data processing solution belonging to a product, such as the cloud backend of an app or device. NIS2 may apply to such services instead.
- Free and open-source software supplied outside the course of a commercial activity
What has to be reported
1. Actively exploited vulnerabilities
These are vulnerabilities in your product for which there is reliable evidence that attackers are already exploiting them. It does not matter whether your own customers are affected. A typical signal is an entry in CISA's Known Exploited Vulnerabilities (KEV) catalog, even when the flaw sits in a bundled library.
2. Severe security incidents
An incident is severe if it affects, or is capable of affecting, the availability, authenticity, integrity or confidentiality of important data or functions of the product, or if it has led or can lead to malicious code being introduced into the product or its users' systems (Art. 14(5)). A tampered update shipped from a compromised build server, for example, can fall under this.
Deadlines
| Stage | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | within 24 hours of becoming aware | within 24 hours of becoming aware |
| Notification | within 72 hours: product, nature of the exploit, measures taken and recommended | within 72 hours: nature of the incident, initial assessment, measures |
| Final report | no later than 14 days after a fix or mitigation is available | within one month of the notification |
The CSIRT designated as coordinator may also request an intermediate report on the current status (Art. 14(6)). The clock starts when you become aware, not when a patch is ready. If you only review vulnerability alerts once a week, you will usually have missed the 24 hours already.
Where reports go
Reports are submitted through ENISA's single reporting platform (Art. 16). They go to the CSIRT designated as coordinator in the member state where the manufacturer has its main establishment and are simultaneously accessible to ENISA (Art. 14(7)); in Germany that is the BSI. The main establishment is the state where decisions on the cybersecurity of the products are predominantly taken. Manufacturers without a main establishment in the EU report, in this order, to the CSIRT of the state where their authorised representative is based, where the importer or distributor handling most of their products is based, or where most of their users are.
You must also inform the users of the affected product and, where necessary, tell them how to mitigate the issue (Art. 14(8)). Voluntary reports of vulnerabilities, near misses and threats are possible as well (Art. 15).
Penalties
Infringements of Article 14 can be fined up to €15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)).
Checklist for the coming weeks
- List your products: which of your products have digital elements and are on the EU market, including older versions?
- Know your components: an up-to-date SBOM for every shipped version, so you know whether a new vulnerability affects you.
- Match continuously: check SBOMs automatically against vulnerability databases and the KEV catalog, not only at release.
- Assign responsibility: who assesses, who reports, who covers during holidays? The 24 hours also run at weekends.
- Prepare access: set up your account for the ENISA platform and the contact route to your CSIRT before the first case.
- Prepare user notices: keep a template and a channel for security advisories to customers ready.
- Involve suppliers: agree in your contracts that suppliers inform you quickly about exploited flaws in their components.
How Secupipe helps
Secupipe continuously matches the SBOMs from your pipelines against OSV, EPSS and the KEV catalog. When a vulnerability in your components shows up as actively exploited, you see it right away, with the running 24-hour, 72-hour and 14-day deadlines and a prepared report draft. Every step is logged so you can later prove when you became aware and how you responded. You still submit the report yourself through the ENISA platform.