Cyber Resilience Act: reporting obligations for manufacturers since September 2026

Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act (CRA). The obligation applies more than a year before the CRA's main cybersecurity requirements take effect on 11 December 2027, and it covers products already on the market. For many manufacturers of connected machines, devices and software, it is the first part of the CRA that has practical consequences.

This article explains what has to be reported, within which deadlines and through which channel, and what manufacturers should have in place now.

Scope and timeline of the CRA

The Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements made available on the EU market. This includes hardware and software whose intended or foreseeable use involves a direct or indirect data connection to a device or network, from industrial controllers and connected machines to consumer devices and standalone software.

The CRA applies in stages:

Date	What applies
10 December 2024	Entry into force
11 June 2026	Rules on notification of conformity assessment bodies
11 September 2026	Reporting obligations for manufacturers (Article 14)
11 December 2027	All other obligations, including the essential cybersecurity requirements and CE marking under the CRA

The reporting obligations therefore apply in a transitional phase in which most products do not yet have to meet the CRA's design requirements. They also apply to products placed on the market before 11 December 2027.

What must be reported, when and to whom

Article 14 CRA covers two types of events. The first is an actively exploited vulnerability, meaning a vulnerability in the product that a malicious actor is already exploiting. The second is a severe incident having an impact on the security of the product, for example an attack that compromises the integrity of the product or the manufacturer's update process.

For both, reporting runs in three stages, counted from the moment the manufacturer becomes aware of the event. According to the Commission's overview of the reporting obligations:

Stage	Deadline: actively exploited vulnerability	Deadline: severe incident
Early warning	Within 24 hours	Within 24 hours
Notification	Within 72 hours	Within 72 hours
Final report	No later than 14 days after a corrective measure is available	Within one month of the 72-hour notification

All notifications are submitted once, through the CRA Single Reporting Platform operated by ENISA. The platform went live on 11 September 2026. The notification goes to the CSIRT of the Member State where the manufacturer has its main establishment and, as a rule, is made available to ENISA at the same time. The CSIRT then shares it with the CSIRTs of the other Member States in which the product is available.

In addition, manufacturers must inform affected users about the vulnerability or incident and, where necessary, about corrective or mitigating measures.

Two clarifications from the Commission's guidance are particularly relevant in practice. Manufacturers do not have to report retrospectively an actively exploited vulnerability that they were already aware of before 11 September 2026. Separate guidance addresses vulnerabilities in third-party components integrated into the product. Open-source software stewards are subject to their own reporting obligations only from 11 December 2027.

What manufacturers should have in place

A 24-hour deadline leaves no time to work out responsibilities once an event has occurred. The following points should be settled in advance:

• Product overview: which products with digital elements are on the EU market, in which versions and in which Member States.
• Component overview: which third-party and open-source components each product contains, so that a published vulnerability can be matched to the affected products quickly.
• Monitoring and escalation: who monitors vulnerability information, who decides whether a report is required and who submits it, including outside office hours.
• Access to the Single Reporting Platform: set up before the first report is needed.
• User information: prepared templates and channels to inform affected users.
• Coordination with other reporting duties: the same event can also trigger reporting obligations under NIS 2 or the GDPR, with different recipients and deadlines.

The reporting obligations are only the first step. By 11 December 2027, products must also meet the essential cybersecurity requirements in Annex I CRA. These include secure design, a cybersecurity risk assessment, vulnerability handling throughout the support period, security updates and a software bill of materials. Products must then undergo the applicable conformity assessment and carry the CE marking on that basis. The processes set up for reporting form part of the vulnerability handling that Annex I requires anyway.

How ArtemLEX supports manufacturers

Much of the preparation for the CRA depends on information that is spread across departments and suppliers: which products fall within scope, which requirements apply to them and which documentation already exists. The ArtemLEX CRA Compliance Studio brings this together in one workflow.

The studio sets out the CRA requirements for each product and supports manufacturers in four areas:

• Compliance checks: existing internal and technical documentation is assessed against the CRA requirements, and gaps are flagged for review.
• Compliance documentation: technical documentation, information and instructions for users and the EU declaration of conformity are prepared, together with the preparation of the conformity assessment procedure.
• Cybersecurity risk assessment: the risk assessment required to demonstrate the essential cybersecurity requirements is supported and, where possible, partly automated.
• Authorised representation: for manufacturers without an EU establishment, ARTEM can act as authorised representative and work with market surveillance authorities on their behalf.

Changes to the legal framework, such as new Commission guidance or implementing acts, are tracked through regulatory monitoring updated daily from the Official Journal.

ArtemLEX does not replace the manufacturer's own vulnerability handling or the decision on whether an event must be reported. It provides the structured product and supplier information on which those decisions and the later conformity assessment rely. More information is available at go.artem.earth.

Some important FAQs

Do the reporting obligations apply to products already on the market?

Yes. The reporting obligations under Article 14 also apply to products with digital elements placed on the market before 11 December 2027.

Does every vulnerability have to be reported?

No. The obligation covers actively exploited vulnerabilities, meaning vulnerabilities that are already being exploited by a malicious actor, and severe incidents affecting the security of the product. Vulnerabilities that are known but not exploited are handled under the manufacturer's vulnerability handling process and, from December 2027, under the requirements of Annex I.

Does a vulnerability known before 11 September 2026 have to be reported?

According to the Commission's FAQs, a manufacturer does not have to report retrospectively an actively exploited vulnerability of which it was already aware before 11 September 2026.

Where are reports submitted?

Through ENISA's CRA Single Reporting Platform. A single notification reaches the competent CSIRT and, as a rule, ENISA at the same time.

Do open-source projects have to report?

Open-source software stewards have their own reporting obligations, which apply from 11 December 2027. A manufacturer that integrates open-source components into its product remains responsible for reporting as manufacturer.

Summary

The CRA's reporting obligations have applied since 11 September 2026, well before the regulation's main requirements in December 2027. Manufacturers must report actively exploited vulnerabilities and severe incidents in three stages, starting with an early warning within 24 hours, through ENISA's Single Reporting Platform. The obligation also covers products already on the market. Meeting these deadlines requires a clear overview of products and components and defined internal responsibilities. The same structures form the basis for the vulnerability handling and documentation that the CRA requires from December 2027.

Key facts

• Reporting obligations under Article 14 CRA apply from 11 September 2026; the remaining obligations from 11 December 2027.
• Reportable events are actively exploited vulnerabilities and severe incidents affecting the security of the product.
• Deadlines: early warning within 24 hours, notification within 72 hours, final report within 14 days of a corrective measure (vulnerabilities) or within one month of the notification (incidents).
• Reports are submitted once through ENISA's Single Reporting Platform and reach the competent CSIRT and ENISA.
• The obligations also apply to products placed on the market before 11 December 2027.
• Vulnerabilities known before 11 September 2026 do not have to be reported retrospectively.
• Open-source software stewards have reporting obligations from 11 December 2027.

Sources

• Regulation (EU) 2024/2847 (Cyber Resilience Act)
• European Commission: Cyber Resilience Act – Reporting obligations
• ENISA: The CRA Single Reporting Platform is launched
• ENISA: Single Reporting Platform FAQ