Most of the EU Cyber Resilience Act (CRA) does not apply until 11 December 2027. One part started early. Under Article 14, since 11 September 2026, manufacturers of products with digital elements made available in the EU must report actively exploited vulnerabilities and severe incidents affecting product security. ENISA switched on the CRA Single Reporting Platform (SRP) on the same day.
The timeline
The reporting duty applies to in-scope products already on the EU market, including those placed there before the rest of the law takes effect.
What you must report, and when
For an actively exploited vulnerability:
- Early warning within 24 hours of becoming aware that it is being exploited.
- Notification within 72 hours, with more detail such as the nature of the issue and any mitigation.
- Final report within 14 days after a corrective or mitigating measure is available.
Severe incidents that affect product security follow a similar rhythm, with a final report due within one month after the 72-hour notification. You file once through the SRP, and it reaches the national CSIRT coordinating your report and ENISA at the same time.
"Actively exploited" means there is reliable evidence that someone has used the flaw maliciously without the system owner's permission. A bug that is merely severe, or a proof of concept, is not automatically reportable. Check the definitions in the regulation and the Commission's guidance.
Who is a "manufacturer"?
The obligation sits with the manufacturer: whoever designs or makes the product, or has it designed or made and markets it under their name. Importers and distributors have their own duties. A company that substantially modifies a product, or markets it under its own name, can be treated as the manufacturer. Open-source stewards have more limited duties, and the details matter, so read the guidance for your case.
A starter checklist for engineering teams
- Name an owner. One person or team decides what is reportable and files it.
- Register on the SRP ahead of time, and check how your organization's users and roles are set up.
- Make "exploited" detectable. Collect signals from support, threat intelligence, telemetry, and security researchers into one triage queue.
- Write the 24-hour playbook. Who is on call, what the early warning needs to say, and how you will confirm what you know.
- Track fix availability. The 14-day final report is tied to the moment a fix or mitigation exists.
- Keep an SBOM (software bill of materials) so you can tell fast whether a newly exploited third-party flaw affects you.
- Rehearse it. A tabletop exercise will reveal missing contacts and approvals.
Why this matters beyond lawyers
Reporting deadlines of hours, not weeks, change how engineering and security teams work. They need a decision-maker reachable on a Saturday and clear criteria for "is this exploited?" This week's news, such as a poisoned security-tool update, shows how fast incidents unfold.
Sources
- European Commission: CRA reporting obligations
- ENISA launched the CRA Single Reporting Platform (Help Net Security)
- Irish NCSC: EU Cyber Resilience Act
Overview as of November 5, 2026. This is not legal advice.