When did the Cyber Resilience Act reporting obligations start?

11 September 2026. Since that date, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. The CRA's main obligations follow on 11 December 2027.

What changes on 11 December 2027?

The rest of the CRA applies: the essential cybersecurity requirements of Annex I, vulnerability handling including a software bill of materials, a declared support period, conformity assessment by product class, technical documentation, and CE marking. Products placed on the EU market from that date must comply.

How fast must a vulnerability be reported under CRA Article 14?

An early warning is due within 24 hours of the manufacturer becoming aware. A full notification follows within 72 hours. A final report is due within 14 days of a corrective measure becoming available for an actively exploited vulnerability, or within one month for a severe incident.

Does the CRA apply to products already on the market?

Yes. The reporting duty attaches to the manufacturer of a product with digital elements made available on the EU market, including products shipped years earlier that are still supported.

Who does a manufacturer report to?

Reports are submitted once, through the CRA Single Reporting Platform, to the CSIRT designated as coordinator in the member state of the manufacturer's main establishment. ENISA receives the notification simultaneously, and the receiving CSIRT forwards it to other CSIRTs where the product is available.

The Cyber Resilience Act: reporting is live, CE marking is next

Two parts of Regulation (EU) 2024/2847 already apply. Since 11 September 2026, any manufacturer of a product with digital elements sold into the EU has 24 hours to warn the authorities once it knows a vulnerability in its product is being actively exploited. On 11 December 2027 the rest arrives: essential security requirements, vulnerability handling, conformity assessment and CE marking. This page tracks where the regulation stands and what product teams need before the second date.

—

until the CRA's main obligations apply

11 December 2027

Where it stands, November 2026

Reporting is live. ENISA opened the CRA Single Reporting Platform on 11 September 2026, the day Article 14 began to apply. ENISA describes this as an initial version and says more functions will follow.
Product classes are defined. Implementing Regulation (EU) 2025/2392, in force since 21 December 2025, gives the technical descriptions of the important (Class I and II) and critical product categories. Your class decides your conformity route in 2027.
Notified bodies are being set up. The rules for conformity assessment bodies have applied since 11 June 2026, and the CRA asks member states to have enough of them in place by 11 December 2026. These are the bodies that will assess Class II and critical products.
Harmonised standards are still in the works. The Commission asked the European standards bodies for 41 CRA standards (request M/606); the first horizontal ones, the EN 40000 series, are in the approval stage. None is cited in the Official Journal yet, and until one is, a Class I product cannot rely on self-assessment alone.
Commission guidance is out. The Commission published implementation guidance for manufacturers on 27 July 2026.

Applies now: the reporting cascade

Article 14 sets four clocks, all of them running from the moment the manufacturer becomes aware, not from the moment it finishes investigating.

24 hours Early warningThat an actively exploited vulnerability or a severe incident exists. A holding notice: it does not need root cause or a fix.
72 hours Full notificationGeneral information on the vulnerability or incident, its nature, and any corrective or mitigating measures taken or available.
14 days Final report — vulnerabilitiesDue within 14 days of a corrective or mitigating measure becoming available.
1 month Final report — severe incidentsDue within one month of the full notification.

The 24-hour clock is the part teams underestimate. It presumes someone is already watching, already empowered to declare, and already knows which CSIRT to file with. Most hardware organisations have none of those three on a weekend.

The duty binds manufacturers of products with digital elements on the EU market: software, IoT devices, industrial and OT systems, networking gear, connected appliances and embedded systems. Legacy products count: reporting covers products already on the market and still supported, not only what ships after the date. Being outside the EU does not exempt you: placing the product on the EU market is what triggers it.

Reports are filed once, through the Single Reporting Platform, to the CSIRT designated as coordinator in the member state of the manufacturer's main establishment, with ENISA receiving it at the same time. That CSIRT forwards it to the other member states where the product is sold.

Coming 11 December 2027: the main obligations

From that date, a product with digital elements placed on the EU market must meet the CRA before it ships. The work behind each item below is product design work, which is why fourteen months is not a long runway.

Essential requirements (Annex I, Part I). Secure by default, no known exploitable vulnerabilities at release, protection of data and interfaces, a minimised attack surface, and the ability to receive security updates.
Vulnerability handling (Annex I, Part II). A software bill of materials, a coordinated vulnerability disclosure policy, and security updates provided free of charge.
A declared support period. Normally at least five years, or the product's expected time in use if that is shorter, stated at the point of sale.
Conformity assessment by class. Default products may self-assess. Class I may self-assess only when applying harmonised standards or an equivalent; otherwise a notified body is involved. Class II requires a third party. Critical products may require European cybersecurity certification.
Technical documentation and CE marking. The EU declaration of conformity, the CE mark, and documentation kept for ten years or the support period, whichever is longer.
Open-source stewards. Their own lighter obligations, including reporting, start on the same date.

Products placed on the market before 11 December 2027 fall under the main requirements only if they are substantially modified afterwards. Reporting under Article 14 already covers them.

The CRA timeline

10 Dec 2024Regulation (EU) 2024/2847 enters into force.
21 Dec 2025Implementing Regulation (EU) 2025/2392 on important and critical product categories in force.
11 Jun 2026Chapter IV applies — notification of conformity assessment bodies.
27 Jul 2026European Commission publishes implementation guidance for manufacturers.
11 Sep 2026Article 14 reporting applies; ENISA's Single Reporting Platform opens.
11 Dec 2026Target for member states to have enough notified bodies in place.
11 Dec 2027Main obligations apply — essential requirements, vulnerability handling, conformity assessment, CE marking.

What to have ready

Now, for reporting

A named on-call owner with authority to declare, and a documented deputy.
The identity of your coordinating CSIRT and an account on the Single Reporting Platform, written down where the on-call owner can find them.
A vulnerability intake channel that a researcher can actually reach, and that someone reads.
A pre-drafted early-warning template, because 24 hours is not the time to start writing one.

Before December 2027, for the product

Classify each product against Annexes III and IV and Implementing Regulation 2025/2392. If it is Class II or critical, start talking to notified bodies now; their capacity will be the bottleneck.
Produce an SBOM for every supported product, so "which products are affected" is answerable in hours rather than weeks.
Decide the support period, and check that the update infrastructure and the business model can carry it.
Run a gap assessment against Annex I. ETSI EN 303 645 is a reasonable proxy while the harmonised standards are pending.

Free tools to check where you stand

Three companion tools from Tangibles, all free and requiring no sign-up to run:

IoT Security Scorecard → A 19-question audit aligned with ETSI EN 303 645. Returns a risk grade, mandatory-compliance flags, and prioritised fixes. Regulatory Landscape → Which frameworks bind your product, by archetype, market, and buyer — CRA, PSTI, IEC 62443, ISO 27001 and more. Security Requirements Generator → An archetype-specific requirement list mapped to EN 303 645 provisions. Exports to Markdown or CSV for a PRD. Chapter 18 sources → The attack-surface case studies behind the chapter, with primary sources and archived snapshots.

Security is chapter 18 of Tangibles

“Connected and Exposed” covers the attack surface of a connected product, from firmware and radios to the cloud and the supply chain. Register and read it free as a PDF: two sample chapters per account.

Or preview the chapter first.

Primary sources

Where this comes from. Chapter 18 of Tangibles — "Connected and Exposed" — works through the attack surface across silicon, firmware, radios, and cloud, and Chapter 19 covers the regulatory response.

Read the chapter preview → · About the book →

This page summarises publicly available regulatory material for product teams planning their readiness work. It is not legal advice, and it is not a substitute for reading Regulation (EU) 2024/2847 or taking qualified counsel on how it applies to a specific product. Last reviewed 4 November 2026.