Since September 11, 2026, manufacturers of products with digital elements sold in the European Union must report actively exploited vulnerabilities and severe security incidents under Article 14 of the Cyber Resilience Act (CRA). Reports go through a new Single Reporting Platform run by ENISA, the EU cybersecurity agency. Most other CRA requirements apply from December 11, 2027, but the reporting duty is already live and covers software as well as hardware.
What applies now
According to a client alert from law firm Crowell published on the day the rules took effect, manufacturers must follow a staged process once they become aware of an actively exploited vulnerability or a severe incident:
| Step | Deadline |
|---|---|
| Early warning | Within 24 hours of becoming aware |
| Notification with available details | Within 72 hours of becoming aware |
| Final report | Within 14 days after a corrective measure is available for a vulnerability, or within one month for a severe incident |
One submission through the Single Reporting Platform reaches both ENISA and the national computer security incident response team (CSIRT) designated as coordinator. Analysis from law firm HLC adds several points:
- the obligations cover hardware, software and remote data processing solutions that are part of a product;
- they apply to products placed on the EU market before September 11, 2026, and continue after a product's support period ends;
- registration on the platform uses EU Login accounts with multi-factor authentication;
- separate reporting duties for open-source software stewards apply from December 11, 2027.
Why it matters for companies hiring IT firms
If your company places software, apps or connected devices on the EU market, you may count as the manufacturer under the CRA even if an outside agency wrote the code. Your organization then needs a way to learn about exploited vulnerabilities quickly and report within 24 hours. Development and maintenance contracts should cover how your vendor tells you about security issues, how fast fixes are delivered, and who prepares the technical information needed for reports. Because scope questions can be complex, check with legal counsel which of your products are covered.
Questions worth asking your development or maintenance partner:
- How will you tell us if you learn of an actively exploited vulnerability in our product, and how fast?
- Which components and open-source libraries does the product contain, and how are they tracked?
- Who prepares the technical details we need for the 72-hour notification and the final report?
Why it matters for IT firms
Development and maintenance firms are often the first to see a security problem in a client's product. Clear escalation paths, vulnerability handling procedures and records now support a legal obligation, not only good practice. Firms that sell their own software products in the EU are manufacturers themselves and need to be registered and ready to file. With the rest of the CRA applying from December 11, 2027, firms that prepare now can also help clients get ready for the wider requirements.
What to do next
- Confirm whether your products fall under the CRA and which entity acts as manufacturer.
- Register on ENISA's Single Reporting Platform and assign responsible staff with EU Login access.
- Write a reporting runbook covering the 24-hour, 72-hour and final report stages.
- Update vendor contracts to include vulnerability notification timelines and responsibilities.
This is a news summary, not legal advice. To find partners for secure development, browse software development companies or IT firms in Europe on Trusted IT Firms, and list your company if you offer security services.
Frequently asked questions
What changed on September 11, 2026?
Article 14 of the EU Cyber Resilience Act started to apply, requiring manufacturers to report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform.
What are the CRA reporting deadlines?
An early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix for vulnerabilities or within one month for severe incidents.
Does the CRA reporting duty cover products already on the market?
Yes. According to HLC, it applies to products placed on the EU market before September 11, 2026 as well.
When do the other CRA requirements apply?
Most other CRA obligations apply from December 11, 2027.
Sources
Add trusteditfirms.com as a preferred source on Google, or open this page in your AI assistant to use it as a source.
