- within Media, Telecoms, IT and Entertainment topic(s)
- with Senior Company Executives, HR and Inhouse Counsel
- in European Union
- in European Union
- in European Union
- in European Union
- in European Union
- with readers working within the Oil & Gas, Retail & Leisure and Utilities industries
The European Commission has published guidance on the Cyber Resilience Act, weeks before its mandatory 24-hour vulnerability and incident reporting obligations begin to apply.
On July 27, 2026, the European Commission published its guidance on the application of Regulation (EU) 2024/2847, the Cyber Resilience Act ("CRA"). The guidance is non-binding, but market surveillance authorities and notified bodies are expected to look to it for a consistent reading of the rules. It exceeds more than 80 pages and includes practical examples, use cases, and flowcharts.
Most CRA obligations apply from December 11, 2027. The reporting obligations, however, apply from September 11, 2026. These reporting obligations cover all products with digital elements within the scope of the CRA, including products already placed on the market before December 11, 2027.
Manufacturers must notify any actively exploited vulnerability in their product, and any severe incident affecting the security of their product, simultaneously to the European Union Agency for Cybersecurity ("ENISA") and to the Computer Security Incident Response Team, or CSIRT, designated as coordinator, through ENISA's Single Reporting Platform ("SRP").
The clock runs from the moment the manufacturer becomes aware:
- Early warning: within 24 hours;
- Notification: within 72 hours;
- Final report: within 14 days after a corrective or mitigating measure is available for actively exploited vulnerabilities, or within one month of the 72-hour notification for severe incidents.
Manufacturers must also inform impacted users and, where appropriate, all users.
Under the guidance, a manufacturer becomes aware once, following an initial assessment, it has a reasonable degree of certainty that a vulnerability in its product is being actively exploited or that a severe incident has compromised the security of its product. The guidance confirms there is no obligation to report retroactively active exploitation that the manufacturer already knew about before September 11, 2026.
Non-compliance with CRA obligations can attract administrative fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher. The SRP is intended to be operational by September 11, 2026.
See also our earlier Alerts on the European Commission's original CRA proposal and the adoption of the CRA.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
