EU Cyber Resilience Act Reporting Rules Are Live
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours. What software sellers in the EU must do now.
On 11 September 2026 the reporting duties of the EU Cyber Resilience Act (CRA) started to apply. Manufacturers of products with digital elements, which includes many software and hardware products sold in the EU, must now report actively exploited vulnerabilities and severe security incidents. The first alert is due within 24 hours of becoming aware. This is general information, not legal advice.
What exactly is required?
According to the European Commission's CRA reporting page, for an actively exploited vulnerability manufacturers must send:
- an early warning within 24 hours of becoming aware;
- a notification with more detail within 72 hours;
- a final report no later than 14 days after a corrective measure is available.
For severe incidents, law-firm commentary describes the final report as due within a month. Confirm the wording of Article 14 of Regulation (EU) 2024/2847 with your adviser.
Reports go through a single reporting platform run by ENISA, the EU cybersecurity agency. It forwards them to the CSIRT (national incident response team) designated as coordinator and to ENISA. Help Net Security reported that the platform launched in mid-September 2026. Some commentary says authorised representatives should register in advance, so do not wait for an incident to find out how it works.
Who does this affect?
Anyone who makes products with digital elements for the EU market. For a startup that means a downloadable app, a firmware image, a developer SDK or a connected device. Pure online services are mostly outside the CRA's main scope, but your adviser should check whether any component you ship counts as a product.
Most other CRA duties, such as conformity assessment and security requirements for design, apply later. McCann FitzGerald's briefing puts most of them at 11 December 2027.
What should a small team do this month?
- Name an owner who can decide that a vulnerability is actively exploited.
- Write a 24-hour runbook: who gets paged, who has the platform login, who drafts the report.
- Keep a software bill of materials so you can tell quickly whether a third-party flaw affects you.
- Publish a security contact and a vulnerability disclosure policy.
- Practice once. A tabletop run takes an hour and exposes missing logins.
For help with scanning and monitoring, see the Security, Privacy & Compliance hub on Woodander.
FAQ
Does the 24 hours start when a CVE is published?
Sources differ on wording. The common reading is that it starts when you become aware of an actively exploited vulnerability, not when a CVE number appears.
Do I need to report every bug?
No. The duty covers actively exploited vulnerabilities and severe incidents.
