The EU Cyber Resilience Act (CRA) is usually discussed as a 2027 problem. One part of it is not. The reporting obligation applies from 11 September 2026, and law firm commentary published since then describes it as live and enforceable. For any organisation that makes software or connected hardware sold into the EU, a new clock now starts when a product vulnerability is being exploited.
What Is Now in Force
Most CRA obligations apply from 11 December 2027. The reporting duties are the exception. According to Jones Day and Crowell & Moring commentary, they cover products with digital elements within the CRA’s scope, including products already on the market before December 2027. The Crowell & Moring article describes the scope as connected hardware and software. Neither article gives a formal definition of “manufacturer,” so scoping should be confirmed with counsel against Regulation (EU) 2024/2847.
Two event types trigger a report: an actively exploited vulnerability in a product, and a severe incident affecting a product’s security. Jones Day reports that a manufacturer is treated as aware once, after an initial assessment, it has a reasonable degree of certainty that the event has occurred. It also states there is no duty to report retroactively exploitation the manufacturer knew about before 11 September 2026.
The Deadlines
Both sources give the same timetable, measured from the point of awareness:
- Early warning: within 24 hours.
- Notification: within 72 hours, with the information available at that point.
- Final report: for an exploited vulnerability, within 14 days after a corrective or mitigating measure is available. For a severe incident, within one month of the 72-hour notification.
For a board, the key point is that the 24-hour clock runs from awareness, not from a fix. A vulnerability being exploited with no patch ready is exactly when the first report is due.
How Reporting Works
Reports go through the Single Reporting Platform (SRP) operated by ENISA, the EU cybersecurity agency. Crowell & Moring states it has been live since 11 September 2026. One submission reaches both ENISA and the CSIRT (national incident response team) designated as coordinator, which may share it with other national teams. This is described as avoiding separate filings in each member state, in contrast to the experience with GDPR and NIS2.
Practical details from the same source:
- Each manufacturer nominates one primary and up to 20 secondary authorised representatives, who log in with individual EU Login accounts using multi-factor authentication.
- The coordinating CSIRT is in the member state where cybersecurity decisions for the products are predominantly taken. Crowell & Moring notes that no published EU or ENISA indicators exist for this test, and that a wrong choice risks invalidation and resubmission.
Penalties
Jones Day states that non-compliance can lead to administrative fines of up to EUR 15 million or 2.5 percent of total worldwide annual turnover, whichever is higher. We did not open the Regulation text itself, so confirm the penalty tier and the article that applies to reporting failures before quoting this figure in board material.
What This Means for the CISO
Much of what follows is our inference from the sources, not regulatory guidance.
If your company makes products. The security function typically does not own the product, but it will often own the clock. Decide now who declares “reasonable certainty,” who can file, and who covers out-of-hours. Document the coordinating CSIRT analysis before an incident. Keep an incident log recording the awareness time, the classification decision and the submission record, so the 24-hour decision can be defended later.
If your company buys products. The CRA does not remove your own obligations under NIS2 or GDPR. Crowell & Moring advises planning incident response for all three together, but gives no detail on how the filings interact, and we found none in the sources opened. Treat that as an open question for legal counsel. Meanwhile, expect supplier notifications to change. Ask key vendors whether they have registered authorised representatives and how quickly they will tell you about exploited flaws in their products. Crowell & Moring recommends requiring component suppliers to notify you of vulnerabilities by contract.
For the board. Three questions are worth asking at the next risk committee. Which of our products are in scope? Who decides when we are “aware,” and can they act within 24 hours at 3 a.m.? Have we rehearsed it?
What We Could Not Verify
We did not open the text of Regulation (EU) 2024/2847, the European Commission’s guidance published on 27 July 2026 (as reported by Jones Day), or ENISA’s own platform documentation, or the CSA note on the platform (unreadable PDF). No evidence was found as of 2026-10-27 in the two law firm articles opened of any rule on how end users must be notified; Jones Day says manufacturers must inform impacted users, while Crowell & Moring does not address it.
Sources
- Jones Day, “EU Cyber Resilience Act: 24-Hour Reporting Duties Start September 11, 2026” (July 2026)
- Crowell & Moring via Legal 500, “It’s live: the Cyber Resilience Act reporting is mandatory as of today, 11 September 2026” (15 September 2026)