EU Cyber Resilience Act reporting duties now apply to manufacturers
Since 11 September 2026, makers of products with digital elements must report exploited vulnerabilities and severe incidents within 24 hours via ENISA's platform.
What happened
The reporting obligations in Article 14 of the EU Cyber Resilience Act (CRA) have applied since 11 September 2026. Manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe security incidents. ENISA's Single Reporting Platform is live: a manufacturer reports once, to the CSIRT of its main establishment, and ENISA receives the information at the same time.
The deadlines
- Early warning within 24 hours of becoming aware.
- Notification within 72 hours.
- Final report within 14 days of a corrective measure being available for an exploited vulnerability, or within one month of the notification for a severe incident.
What to do now
- Check whether you place hardware or software with digital elements on the EU market. If you do, these duties already apply.
- Make sure your security team can spot exploitation of your own products quickly enough to meet a 24-hour clock.
Our blog explains what the CRA's 24-hour clock means in practice.
Sources
Prepared with AI assistance by the Claire Security research team, based on the sources listed.
Catch threats like these around the clock
Claire Security triages every alert with auditable AI, on your own servers.
Request a demo