EU Cyber Resilience Act reporting duties take effect

Manufacturers of products with digital elements (hardware and software, from routers to smart-home apps) must now report actively exploited vulnerabilities and severe security incidents via the ENISA-run Single Reporting Platform: an early warning within 24 hours, a full notification within 72 hours and a final report within 14 days or one month respectively. The obligation also covers products placed on the market before the CRA becomes fully applicable in December 2027.

The date follows from Art. 71 of Regulation (EU) 2024/2847 (Cyber Resilience Act), which entered into force on 10 December 2024: the Art. 14 reporting obligations apply from 11 September 2026, the rules on conformity assessment bodies since June 2026, and the full product requirements from 11 December 2027. ENISA launched the Single Reporting Platform the same day; notifications are routed from there to the competent national CSIRTs (Crowell & Moring, Freshfields, 11 September 2026).