CRA reporting obligations since 11 September 2026: what manufacturers must report now.

What must be reported

• any actively exploited vulnerability in a product with digital elements that the manufacturer becomes aware of (Article 14(1))
• any severe incident having an impact on the security of the product (Article 14(3))
• an incident is severe if it negatively affects the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or if it has led or can lead to the introduction or execution of malicious code (Article 14(5))

The deadlines

All deadlines run from the moment the manufacturer becomes aware. Information already submitted does not need to be repeated.

• 24 hours: early warning; for vulnerabilities including the Member States where the product has been made available; for incidents also whether unlawful or malicious acts are suspected
• 72 hours: notification with general information on the product, the nature of the exploit or incident, measures taken and measures users can take
• Vulnerability: final report no later than 14 days after a corrective or mitigating measure is available, with description, severity, impact and the correction provided (Article 14(2))
• Incident: final report within one month after the 72-hour notification, with root cause and mitigation measures (Article 14(4))

Where to report

Reports are submitted via the single reporting platform operated by ENISA (Article 16), using the endpoint of the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the EU. This is the Member State where decisions on the cybersecurity of the products are predominantly taken (Article 14(7)). ENISA has simultaneous access.

The CSIRT may request intermediate reports (Article 14(6)).

Users and open-source components

• Affected users, and where appropriate all users, must be informed about the vulnerability or incident and possible mitigations, where appropriate in a machine-readable format (Article 14(8))
• If the manufacturer identifies a vulnerability in an integrated component, including an open-source one, it reports it to the person or entity manufacturing or maintaining the component (Article 13(6))
• If the manufacturer has developed a fix for the component, it shares the code or documentation with the maintainer

Does this also apply to older products?

Yes. For products placed on the market before 11 December 2027, the other CRA requirements only apply after a substantial modification. The reporting obligations under Article 14, however, explicitly apply to these products as well (Article 69(3)).

What teams should have prepared

• a component inventory and release-specific SBOM to clarify quickly which products and versions are affected
• triage with criteria for “actively exploited”, for example based on exploit indicators and catalogues such as CISA KEV
• defined ownership, deputies and approval for reports, so that 24 hours can be met at weekends too
• templates for early warning, notification and final report as well as for user information
• a route for reporting vulnerabilities to open-source maintainers