EU Cyber Resilience Act Reporting Duties Go Live: 24 Hours to Flag an Exploited Bug
Since September 11, makers of connected products sold in Europe must report actively exploited vulnerabilities and severe incidents on a strict clock.
Key takeaways
- Article 14 reporting began on 11 September 2026; most other CRA duties follow on 11 December 2027.
- Manufacturers owe a 24-hour early warning and a 72-hour follow-up via ENISA's single reporting platform.
- Fines can reach 15 million euros or 2.5% of worldwide turnover, whichever is higher.
The first binding piece of the EU Cyber Resilience Act (CRA) took effect on 11 September 2026. Anyone who makes or sells products with digital elements in the EU must now tell authorities when they learn a vulnerability is being actively exploited, starting a 24-hour clock.
What changed
The CRA sets cybersecurity requirements for hardware and software across the single market, from routers and smart-home gear to apps and industrial components. Most of its design and conformity obligations do not bite until 11 December 2027. Article 14, the reporting rule, arrives more than a year earlier.
Two kinds of events trigger it: a vulnerability a manufacturer knows is being actively exploited, and a severe security incident affecting a product. The manufacturer must send an early warning within 24 hours of becoming aware, then a fuller notification within 72 hours. Reports go through a single reporting platform run by the EU cybersecurity agency ENISA, routed to the manufacturer's national CSIRT. The European Commission's guidance says the platform was due to be operational by the start date, although some law-firm commentary noted testing was still under way.
Scope and sharp edges
Three details are catching compliance teams out. First, the duty covers products already on the market, not just new launches. Second, there is no retroactive reporting: a vulnerability whose exploitation the maker knew about before 11 September does not need a report, but if exploitation is discovered later, the clock starts then. Third, reporting continues after support ends, unlike the CRA's patching duties, which last only through the support period.
The rule also does not itself force a fix. It is a disclosure mandate that feeds national authorities, not a patch deadline. Penalties for breaching CRA obligations can reach 15 million euros or 2.5% of total worldwide annual turnover, whichever is higher.
Why it matters
Until now, vulnerability disclosure in the EU was largely voluntary and uneven. A single EU-wide channel means regulators will see exploitation trends across vendors in near real time, and it gives buyers leverage to ask suppliers about their reporting readiness. Open-source maintainers and small firms face the hardest adjustment, since they need an internal process that can produce a report within a day.
What manufacturers have to build now
The text of the law is short; the operational burden is not. A manufacturer needs to answer, at any hour, three questions: is this vulnerability being actively exploited, does it affect one of our products on the EU market, and who signs off on telling a regulator. Law-firm checklists published around the start date converge on the same preparation steps. Appoint an on-call reporting owner with authority to file. Map products to their components so that a third-party library flaw can be traced to affected shipments quickly. Define internal triggers for what counts as active exploitation, such as a credible customer report, a threat-intelligence match or a listing in a public catalogue of exploited bugs.
The cross-border angle adds complexity. Reports flow through ENISA's platform but are coordinated with the national CSIRT of the member state where the manufacturer has its main establishment, so a company without an EU base has to work out which country applies. Importers and distributors also have duties to alert manufacturers when they spot problems, which pulls retailers and resellers into the process.
Open source is the most delicate case. The CRA tries to exempt non-commercial development while placing duties on commercial users and on organisations that act as stewards of widely used projects. Many maintainers are volunteers without a security team, and foundations are preparing guidance and shared processes so that a project can meet a 24-hour expectation without relying on a single person. Whether that workable middle ground holds will become clear once the first reports about community-maintained components arrive.
There is a security logic behind the speed. An early warning lets national authorities alert other countries and, where appropriate, other vendors whose products share the same component, before a bug becomes a mass-exploitation event. Critics note that rushed 24-hour notices will often be sparse, and that confidentiality of unpatched flaws held by government bodies is itself a risk. The 72-hour follow-up is meant to fill in details as the picture clears.
What to watch
- How reliably ENISA's platform handles the first wave of reports.
- Early national enforcement and guidance for open-source stewards.
- Whether manufacturers begin publishing coordinated disclosure policies to prepare for 2027.
Sources
- EU Cyber Resilience Act 24-hour reporting duties start September 11, 2026 — Jones Day
- Get Ready: Reporting FAQs and Checklist as the EU's Cyber Resilience Act Comes Into Force — Skadden
- CRA reporting — European Commission
- The EU Cyber Resilience Act's vulnerability and incident reporting requirements are now live — Travers Smith
