Since 11 September 2026, the first obligations of the EU Cyber Resilience Act (CRA) have applied. Manufacturers of products with digital elements, meaning software, apps and connected devices, must report actively exploited vulnerabilities and severe security incidents: an early warning within 24 hours and a notification within 72 hours. Reports go through a platform run by the EU agency ENISA. The CRA's other obligations, such as secure default settings and security updates, follow from December 2027.
What must manufacturers report?
Two kinds of events:
- Actively exploited vulnerabilities: a flaw in your product is already being used in attacks.
- Severe security incidents: an incident significantly affects the security of your product.
The deadlines under Article 14 of the CRA:
- Early warning within 24 hours of becoming aware.
- Notification with further details within 72 hours.
- Final report within 14 days after a fix is available, or within one month for severe incidents.
Reports are submitted via ENISA's Single Reporting Platform and passed on to the responsible national team, in Germany the Federal Office for Information Security (BSI).
Who is affected?
The obligation applies to manufacturers. A manufacturer is also anyone who has a product developed and offers it under their own name or brand. So if you have an agency build an app and release it under your name, you are usually the manufacturer yourself.
Whether pure online services are affected, meaning software that only runs in the browser and installs nothing on the customer's side, is not clear in every case. Many experts consider pure SaaS to be largely outside the CRA. It is different if your offer includes an installable app, desktop software or a device. Check this case by case.
What happens in case of breaches?
For breaches of the essential requirements, the CRA provides for fines of up to 15 million euros or 2.5 percent of worldwide annual turnover. National authorities are responsible for market surveillance.
What should you do now?
- Take stock: which of your products contain software that runs on the customer's side?
- Clarify responsibility: who in the company reports, who covers for them, and who decides on updates?
- Monitor vulnerabilities: keep a list of all libraries you use (a so-called SBOM) and have it checked automatically for known flaws.
- Prepare a reporting process: define how a report gets submitted within 24 hours, including at weekends.
- Plan for updates: make sure you can deliver fixes to your customers quickly.
Many of these steps are part of running software securely anyway. How important fast updates are is shown by the cases in PHP2Shell and, for home-built tools, in vibe coding in companies.
This article is not legal advice. For your specific case, contact your legal advisor.
Sources
- IHK Nürnberg: Cyber Resilience Act: reporting obligations from 11 September 2026 (German)
- Computerweekly: Preparing for the CRA reporting duty (German)
- CRA reporting: 24h, 72h & 14-day deadlines (Article 14)
- NetGuide: Reporting duty for exploited vulnerabilities from 11 September 2026 (German)
