Cyber Resilience Act: vulnerability and incident reporting starts

11 Sep 2026 41 days ago Already applies

Reporting obligations apply · Regulation (EU) 2024/2847 (CRA), Article 14 · European Commission

IndustryInfrastructure EU Law

From 11 September 2026 a manufacturer of a product with digital elements must report an actively exploited vulnerability and any severe incident affecting the product's security to ENISA and the national CSIRT: early warning within 24 hours, notification within 72 hours, final report within 14 days. This applies before the rest of the Act does.

EUR-Lex · European Commission

What to do 0 of 5 done

List every product you place on the EU market that contains software or firmware
Name the person who files reports on the ENISA single reporting platform
Write the internal path from a vulnerability report to a filed early warning within 24 hours
Set up a public point of contact for vulnerability reports and a disclosure policy
Tell users about an exploited vulnerability and the fix without undue delay

Ticks are kept in this browser only. Sign in to the client portal to share them with your team.

Cyber Resilience Act: vulnerability and incident reporting starts

Cyber Resilience Act: vulnerability and incident reporting starts

Need this tracked for your fleet or plant?