What changed on 11 September 2026
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) sets out how secure products with digital elements sold in the EU must be, from industrial controllers and routers to apps. Most of its requirements only apply from 11 December 2027. One obligation, however, has been binding since 11 September 2026: the reporting obligation under Article 14.
Since that date, manufacturers have had to report two things:
- actively exploited vulnerabilities in their products, meaning security flaws that attackers are known to be using, and
- severe incidents that affect the security of the product.
Reports go through the Single Reporting Platform run by ENISA, the EU cyber security agency, which launched in an initial version on 11 September 2026. The report goes to the CSIRT designated as coordinator in the Member State where the manufacturer has its main establishment, and to ENISA at the same time. That CSIRT passes it on to the other countries concerned. ENISA plans to add further features over the coming months.
The deadlines
The clock starts when the manufacturer becomes aware of the vulnerability or incident. According to the European Commission and Article 14:
| Stage | exploited vulnerability | severe incident |
|---|---|---|
| Early warning | within 24 hours | within 24 hours |
| Notification with initial details | within 72 hours | within 72 hours |
| Final report | no later than 14 days after a fix or mitigation is available | within one month of the 72-hour notification |
Manufacturers must also inform affected users in a timely manner about the vulnerability or incident and any steps they can take to protect themselves (Art. 14(8)).
Important: the reporting obligation also covers products that were placed on the market before the deadline (Art. 69(3)). So if you have been selling a connected device or piece of software for years, you do not get to wait until 2027.
Breaches of Article 14 can lead to fines of up to EUR 15 million or 2.5% of worldwide annual turnover (Art. 64(2)). Article 64(10) makes an exception for micro and small enterprises: missing the 24-hour early-warning deadline does not lead to a fine. The duty to report still applies.
Which SMEs are affected
The CRA defines “manufacturer” broadly: any business that develops or has a product with digital elements made, and markets it under its own name or trademark. That can include:
- industry and mechanical engineering, where machines, controllers or sensors contain software or are connected,
- electronics and device makers, even if the device comes from a supplier and is only sold under your own brand,
- software companies and firms with their own app that they sell or provide to customers.
Some areas are excluded because they have their own EU rules, such as medical devices, motor vehicles and aviation. If you are unsure whether your product is in scope, check with your legal adviser or trade association. This article is not legal advice.
For manufacturers in scope, this means having a clear process for how vulnerability reports come in, who assesses them and who files the report within 24 hours, including at weekends.
What everyone else gains: better questions when buying
Most SMEs, law firms and medical practices do not make products; they buy them: firewalls, printers, phone systems, sector-specific software, cameras. For them, the CRA is mainly leverage when purchasing. From December 2027 manufacturers will have to, among other things:
- set a support period during which they fix vulnerabilities, generally at least five years unless the product is expected to be used for less time (Art. 13(8)),
- state the end date of that period (at least month and year) clearly at the time of purchase (Art. 13(19)),
- provide security updates and keep a software bill of materials (SBOM) as part of their technical documentation (Annex I, Part II).
You can already ask your suppliers these questions today.
Checklist
If you are a manufacturer:
- List products with software or network connectivity, including older ones still on sale.
- Assign responsibility and cover for reporting; prepare access to the ENISA platform.
- Set up a channel for vulnerability reports (for example a dedicated address and a disclosure policy).
- Write down and rehearse the 24 h / 72 h / final report process and how you will inform customers.
If you are a buyer:
- Ask suppliers how long security updates will be provided, and until exactly when.
- Request their update policy: how updates are delivered, how quickly, and how customers are told.
- Ask whether an SBOM, or at least a list of key components, is available.
- Build these points into tenders and purchase orders, and record end-of-support dates in your inventory.
How IT United can help
We help you keep track of the devices and software in your organisation, including support end dates and update status. When sourcing hardware and software we look for clear update commitments, and as part of our IT security services we help you install updates regularly. For manufacturers, our IT consulting covers the technical side, such as setting up an intake channel for vulnerability reports.
Would you like to know how long the devices in your business will keep receiving updates? Book a free initial consultation and we will look at it together.
