What has changed?
Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, has applied since 11 September 2026. Manufacturers of products with digital elements must notify every actively exploited vulnerability and every severe incident affecting the security of the product that they become aware of, simultaneously to the CSIRT designated as coordinator and to ENISA, through the single reporting platform.
Notification is staged: an early warning within 24 hours of becoming aware, followed by a detailed notification within 72 hours. For actively exploited vulnerabilities, a final report is due no later than 14 days after a corrective or mitigating measure is available.
Which products are covered?
The reporting obligation applies to all products with digital elements within the scope of the regulation, including those placed on the market before 11 December 2027. The essential cybersecurity requirements and the conformity assessment rules apply in full from 11 December 2027, while the chapter on conformity assessment bodies has applied since 11 June 2026.
What should manufacturers do now?
List the products in your portfolio that are connected or contain software, define who reports vulnerabilities and incidents and within which deadlines, and set up a process to keep the records. Starting the product-by-product risk assessment and technical file for 2027 now avoids the rush of the final months.
Let's assess your product's CRA scope and preparation steps together: Explore our cybersecurity service
