What has changed?
The bulk of the incident reporting requirements under the EU Cyber Resilience Act (CRA) have applied to manufacturers of products with digital elements since September 11, 2026, and the ENISA single reporting platform is now live.
What is the CRA?
The CRA harmonizes cyber security requirements for products with digital elements across EU Member States, establishing a conformity assessment process to demonstrate compliance with cyber security standards. It sets out cyber security requirements for connected products at the design, development, and production phases, and introduces market surveillance rules.
The CRA imposes a range of incident reporting requirements on manufacturers of products with digital elements (and on open-source software stewards—not covered here). A chain of notifications and reports needs to be made to the EU Member State CSIRT (Computer Security Incident Response Team) and ENISA via the single reporting platform, as well as to users, in the event of discovery of actively exploited vulnerabilities and/or severe incidents impacting cyber security of the products.
Who is caught?
The CRA applies to products with digital elements intended for data connections to devices or networks (subject to limited exceptions). While the incident reporting provisions apply mainly to manufacturers, the CRA affects manufacturers, importers, and distributors who make these products available on the EU market, regardless of where they are based, throughout the product’s lifecycle.
When does it apply?
The CRA was published in the Official Journal in November 2024. It will generally apply from December 11, 2027, but Article 14 (manufacturer reporting obligations for actively exploited vulnerabilities and severe incidents) has applied since September 11, 2026, and Chapter IV (conformity assessment bodies) since June 11, 2026. While products placed on the market before December 11, 2027, are only subject to the Regulation if substantially modified, the Article 14 reporting provisions apply to all in-scope products now.
What are the Article 14 incident reporting requirements on manufacturers?
Type of incident |
What needs to be reported? |
By when? |
To whom? |
|---|---|---|---|
|
Actively exploited vulnerabilities in a product with digital elements. |
An early warning notification of an actively exploited vulnerability. |
Without undue delay and in any event within 24 hours. |
To the CSIRT designated as coordinator and to the European Union Agency for Cybersecurity (ENISA) via the single reporting platform established under Article 16. |
|
A vulnerability notification (unless information already provided). |
Without undue delay and in any event within 72 hours of becoming aware. |
||
|
A final report (unless information already provided). |
No later than 14 days after a corrective or mitigating measure is available. |
||
|
Severe incident having an impact on the security of a product with digital elements. |
An early warning notification of a severe incident. |
Without undue delay and in any event within 24 hours. |
|
|
An incident notification (unless information already provided). |
Without undue delay and in any event within 72 hours of becoming aware. |
||
|
A final report (unless information already provided). |
Within one month after the submission of the incident notification above. |
||
|
An intermediate report. |
On request by the CSIRT. |
||
|
An actively exploited vulnerability or severe incident having an impact on the security of a product with digital elements. |
Notification. |
After becoming aware. |
Impacted users and, where appropriate, all users. |
What do you need to do?
If you are a manufacturer of in-scope connected products, you will hopefully have the processes in place to enable you to make the required reports and notifications. Ensure that the reports contain the required information. This includes:
-
Early warning reports must identify the EU Member States in which the relevant product is available and, where related to severe incidents, whether the incident was caused by a malicious actor.
-
Event notifications must include information about the product, an initial assessment of the event, steps being taken to mitigate impact, an assessment of the level of seriousness, and steps users can take to mitigate impact.
-
Final reports require more detailed information about the incident, including its causes, seriousness, and mitigation and correction.
-
User reports need to include information about the event and about what is being done to correct or mitigate its impact. Where necessary, they should also cover mitigation steps and corrective measures users can take. Where appropriate this information should be in machine-readable format.
From December 11, 2027, sanctions for non-compliance with incident reporting requirements can be up to EUR15M or 2.5% of annual global turnover (with limited exceptions for small and micro enterprises in relation to missing the initial 24 hour deadline). This means there is a grace period before fines will be imposed, but compliance should already be in place. Without full preparation, the deadlines will be difficult to meet.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]