EU Cyber Resilience Act – new reporting obligations in force

The EU Cyber Resilience Act (CRA) reporting obligations in Article 14 began to apply on 11 September 2026. They require manufacturers of in-scope products placed on the EU market to notify the Computer Security Incident Response Team (CSIRT) and the European Union Agency for Cybersecurity (ENISA) of actively exploited vulnerabilities or severe incidents.

Manufacturers must submit the notification through the CRA single reporting platform. Reporting has three stages – early warning within 24 hours, a notification within 72 hours, and a final report.

Manufacturers must become familiar with the new reporting obligations and implement practices to ensure compliance.

Reporting under the CRA is in addition to any existing reporting obligations (for example, in relation to personal data breaches under both the UK and EU GDPR). This means that the same incident may also be reportable under other regulatory frameworks.

Scope

Products

In-scope products are those with digital elements, made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network. This encompasses software or hardware products and their remote data processing solutions (ie processing at a distance where the software is designed and developed by, or on behalf of, the manufacturer, and without that processing, the product would be unable to perform one of its functions) – and systems capable of processing, storing or transmitting digital data (like smart devices, apps or household gadgets).

This means services that are not supplied as a software product (such as standalone cloud or SaaS solutions) generally fall outside the scope, unless they contribute to a product’s main functionality. This can be nuanced, and if unclear, it is advisable to undertake an assessment to establish whether or not the offering falls within scope.

Certain products that are regulated by pre-existing and sector-specific EU cyber security rules, such as medical devices, are excluded from the scope of the CRA due to specific exclusions.

Manufacturer

A manufacturer is a natural or legal person who develops or manufactures an in-scope product (or has products with digital elements designed, developed or manufactured) and places it on the EU market under its name or trademark.

Territory

Whilst the CRA is an EU regulation, it has extra-territorial effect. This means that manufacturers who are established outside the EU, for example the UK, US and other jurisdictions, will be required to comply with the CRA if they place their products on the EU market, regardless of whether or not they have an EU establishment.

Actively exploited vulnerability vs severe incident

Actively exploited vulnerability

A vulnerability is a weakness, susceptibility or flaw of an in-scope product that could be exploited by a cyber threat. An actively exploited vulnerability exists where there is reliable evidence that a malicious actor has exploited a vulnerability in a system without permission of the owner.

Severe incident

An incident is an event that compromises, or could compromise, the availability, authenticity, integrity or confidentiality of data or systems. A severe incident is one that negatively affects, or is capable of negatively affecting, a product with digital elements’ ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions. This includes where an incident has led, or is capable of leading, to the introduction or execution of malicious code in a product with digital elements, or in the network and information systems of users of such product.

These definitions make clear that potential compromise or negative impact may be reportable, even if no actual impact has yet occurred or been detected. The incident must nevertheless satisfy the severity criteria; a merely hypothetical or speculative risk would not automatically be reportable.

Three-stage reporting obligations

Early warning

Manufacturers must submit an early warning notification of an actively exploited vulnerability or a severe incident without undue delay and in any event within 24 hours of awareness. The notification must indicate the member states where the manufacturer is aware that the in-scope product has been made available. For severe incidents, the notification must also include whether unlawful or malicious activity is suspected.

Second notification

In the case of an actively exploited vulnerability, manufacturers should, without undue delay and within 72 hours of awareness, provide (unless already provided):

• details of the product;
• general nature of the exploit;
• the vulnerability concerned;
• corrective or mitigating measures taken;
• corrective or mitigating measures for users; and
• the sensitivity of the notified information.

In the case of a severe incident, manufacturers should, without undue delay and within 72 hours of awareness (unless already supplied), provide general information about:

• the nature of the incident;
• an initial assessment;
• corrective or mitigating measures taken;
• corrective or mitigating measures users can take; and
• the sensitivity of the notified information.

Final report

Actively exploited vulnerability
For an actively exploited vulnerability, the final report must be made within 14 days after a corrective or mitigating measure is available. This report must include:

• a description of the vulnerability (severity and impact);
• information about any malicious actors that have exploited or are exploiting vulnerability (where available); and
• details about the security update or corrective measures available to remedy the vulnerability.

Severe incident
The deadline is within one month after the submission of the 72-hour notification for a severe incident. This report must include:

• a detailed description of the incident (severity and impact);
• the type of threat or root cause likely to have triggered the incident; and
• applied and ongoing mitigation measures.

CSIRT may also request manufacturers to provide an intermediate report on relevant updates.

Informing users

Manufacturers must inform impacted users (and where appropriate all users) of the vulnerability or incident and any mitigating or corrective measures.

Where a manufacturer fails to inform users in a timely manner, CSIRT may provide such information to the users when it is considered proportionate and necessary.

Interaction with NIS2 (Network and Information Security Directive 2, EU 2022/2555)

NIS2 regulates cybersecurity for essential and important entities operating in specified sectors. It prioritises protection of network and information systems by requiring organisations to comply with similar reporting obligations to that of the CRA.

The CRA and NIS2 are complementary frameworks. Whilst the CRA focuses on products with digital elements placed on the EU market, NIS2 focuses on the cybersecurity risk management and reporting obligations of essential and important entities. Compliance with NIS2 does not exempt a product from the CRA and the same organisation may be subject to both regimes depending on its activities.

Position in the UK

The Cyber Security and Resilience (Network and Information Systems) Bill (CSRB) is progressing through Parliament, with royal assent anticipated by spring 2027. The CSRB intends to strengthen UK defences against cyber-attacks and protection to key services. It would allow ministers to issue directions in response to national security threats. This may impose additional requirements and protections in the UK.

Requirements to address

Manufacturers should undertake the following to ensure compliance:

• Existing products: identify products currently on the EU market which may fall within scope and assess whether any have experienced, or are susceptible to, a vulnerability or incident.
• Policies and procedures: review and update policies and procedures to include clear guidance on what the reporting obligations are, what is required in each report and the relevant timescales, particularly taking into account other overlapping regulatory obligations.
• Training: provide sufficient training and guidance to employees so that anyone who could potentially be responsible for compliance is up to date and well versed in the reporting obligations.