Cyber Resilience Act reporting obligations are the first part of the EU’s new product security law to become binding: since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours. The rest of Regulation (EU) 2024/2847 applies from December 2027, but the reporting clock is already running.
That sequencing is deliberate. The EU wants visibility into exploited product vulnerabilities now, not in 2027, because a single flaw in a widely deployed product can ripple across thousands of organisations at once. ENISA, the EU’s cybersecurity agency, sits at the centre of the new reporting architecture precisely to spot those ripples early.
For manufacturers, the practical question is not whether the rule applies, it is whether your organisation can meet a 24-hour clock on its worst day.
In this article, we’ll cover what the Cyber Resilience Act reporting obligations require, who must report, the exact deadlines and how to build a process that holds up under pressure.
Who must report, and from when
Manufacturers of products with digital elements placed on the EU market must report, wherever they are based. A software company in Boston selling into the EU carries the same reporting duties as one in Berlin. Importers and distributors have a supporting duty: if they learn of a vulnerability in a product they handle, they must inform the manufacturer without undue delay.
The obligations have applied since 11 September 2026. They are not waiting for the regulation’s full application in December 2027, and they cover products already on the market, not only new releases.
Two categories of events trigger a report:
- Actively exploited vulnerabilities. A vulnerability in your product that someone is actually using against it in the wild, not merely a theoretical finding.
- Severe incidents. Incidents that affect the product’s security through digital elements, such as a compromise of your build or update infrastructure that could push malicious code to users.
The deadlines: 24 hours, 72 hours, 14 days
The CRA sets a three-step reporting rhythm for each trigger. The steps build on each other, so the first notification can be thin as long as it is fast.
Here is the full schedule:
| Trigger | First step | Second step | Final step |
|---|---|---|---|
| Actively exploited vulnerability | Early warning within 24 hours | Vulnerability notification within 72 hours, with available details and any corrective measures | Final report within 14 days after a corrective measure is available |
| Severe incident | Early warning within 24 hours | Incident notification within 72 hours, with initial assessment and mitigations | Final report within 1 month after the incident notification |
Two details catch teams out. First, the clocks start from awareness, the moment the manufacturer becomes aware of the exploited vulnerability or incident, which makes your internal detection-to-decision time part of the deadline. Second, 24 hours means 24 hours, weekends and holidays included.
Where reports go
Reports are submitted through a single reporting platform operated by ENISA, which routes each notification simultaneously to the CSIRT designated as coordinator in the relevant member state and to ENISA itself. Manufacturers report through a single entry point rather than notifying each country separately.
In parallel, manufacturers must inform impacted users of the product about the incident or the exploited vulnerability and, where relevant, the corrective or mitigating measures they can take. Under the CRA, staying quiet toward your own users is not an option once the triggers are met.
If your organisation also falls under NIS2 as an essential entity, note that these are separate regimes: NIS2 covers incidents affecting your services, the CRA covers your products. A single bad day can trigger both, with different recipients and clocks, which is exactly why the response plan should map them side by side.
Building a reporting process that survives contact
A 24-hour regulatory clock is an operations problem wearing a legal costume. The organisations that meet it comfortably have decided everything decidable in advance.
The capabilities to stand up now:
- Detection you can trust. You cannot report what you have not noticed. Product telemetry, a monitored vulnerability disclosure inbox and threat intelligence on your own products feed the trigger. Continuous monitoring through a SOC shortens the awareness gap that eats your 24 hours.
- A decision owner. One named role, with a deputy, empowered to classify an event as reportable at 2am without convening a committee.
- Pre-drafted templates. The early warning asks for little. Draft it in advance so the on-call engineer fills in facts, not prose.
- A rehearsed dry run. One tabletop exercise per year against a realistic scenario, timed against the real deadlines, finds the gaps while they are free. Our guide to the wider regulation, What is the EU Cyber Resilience Act?, covers where reporting fits in the full compliance picture.
- Evidence discipline. The final report requires a description of the vulnerability or incident, its severity and impact, and the corrective measures. If your incident process captures these as it runs, the 14-day report writes itself.
One reassurance worth passing to nervous leadership teams: a report is not an admission of wrongdoing. The regulation expects vulnerabilities to exist. What it penalises is silence.
Frequently Asked Questions
What are the Cyber Resilience Act reporting obligations?
They are the duties under Regulation (EU) 2024/2847 requiring manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents. Reporting starts with an early warning within 24 hours of awareness, followed by a fuller notification within 72 hours and a final report, and the duties have applied since 11 September 2026.
Who do CRA reports go to?
Reports are submitted through the single reporting platform operated by ENISA, which makes them available simultaneously to the CSIRT designated as coordinator in the relevant EU member state and to ENISA. Manufacturers must also inform impacted users of the product about the event and any measures they can take.
Does the 24-hour rule apply to companies outside the EU?
Yes. The reporting obligations apply to manufacturers of products with digital elements placed on the EU market regardless of where the manufacturer is established. A non-EU company selling connected hardware or software into the EU carries the same reporting duties as an EU-based one.
What counts as an actively exploited vulnerability under the CRA?
A vulnerability in the product that a malicious actor is actually using against systems in the real world, as opposed to a vulnerability that has merely been discovered or theorised. Active exploitation is what turns an internal engineering issue into a reportable event with a 24-hour early warning deadline.
How should manufacturers prepare for CRA reporting?
Stand up reliable detection across product telemetry and vulnerability disclosure channels, name a decision owner who can classify events around the clock, pre-draft the early warning template, rehearse the process against the real deadlines once a year and capture evidence during incident response so the final report is a compilation, not a reconstruction.
Meet the 24-Hour Clock with CyberGlobal
Reporting readiness is a capability you build once and rely on for years. We help manufacturers stand up the whole chain: detection and monitoring, the decision playbook, the reporting templates, and the annual rehearsal, with local teams across Europe who know the CSIRT landscape and a global bench behind them. Let’s make sure your worst day runs on a checklist, not on adrenaline.
