Three months to the first CRA deadline that bites
Most of the Cyber Resilience Act (CRA) still feels far away. The regulation, Regulation (EU) 2024/2847, applies in full from 11 December 2027, and that is the date most product teams have in their plans for secure-by-design requirements, conformity assessment and CE marking.
But one obligation arrives much earlier. From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents to the authorities. That obligation is not limited to new products: it also covers connected products that are already on the market. For a company selling smart home devices, connected toys, wearables or any other product with software or a network connection, there are now three months left to set up a process that works within 24 hours.
The three CRA dates
Article 71(2) of the CRA sets three dates of application:
- 11 June 2026 – Chapter IV (Articles 35 to 51), on the notification of conformity assessment bodies, applies. This is the groundwork for the bodies that will assess the more critical product classes later.
- 11 September 2026 – Article 14, the manufacturers’ reporting obligations, applies.
- 11 December 2027 – the rest of the regulation applies, including the essential cybersecurity requirements in Annex I.
The CRA defines a product with digital elements as “a software or hardware product and its remote data processing solutions”, including components placed on the market separately. In practice that covers most consumer products that connect to a phone, a network or the cloud.
What must be reported
Article 14 creates two reporting duties.
Actively exploited vulnerabilities (Article 14(1)). A manufacturer must notify any actively exploited vulnerability in its product that it becomes aware of. The CRA defines an actively exploited vulnerability as one “for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner”. A vulnerability found in your own testing that nobody has exploited is not covered by this mandatory duty, although Article 15 allows voluntary reporting.
Severe incidents (Article 14(3)). A manufacturer must also notify any severe incident having an impact on the security of the product. Article 14(5) treats an incident as severe when it affects, or can affect, the product’s ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or when it has led, or can lead, to malicious code being introduced or executed in the product or in a user’s network and information systems.
24 hours, 72 hours, 14 days and one month
Both duties follow a staged timeline, set out in Article 14(2) and (4):
| Step | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Within 24 hours of becoming aware |
| Notification | Within 72 hours, with general information about the product, the exploit and any corrective or mitigating measures | Within 72 hours, with an initial assessment and measures taken |
| Final report | No later than 14 days after a corrective or mitigating measure is available | Within one month after the incident notification |
The early warning must indicate, where applicable, the Member States where the manufacturer knows the product has been made available. For incidents, it must also say whether the incident is suspected of being caused by unlawful or malicious acts. The CSIRT receiving the report can ask for an intermediate status report (Article 14(6)).
Reporting to the authorities is only half of it. Under Article 14(8), the manufacturer must also inform the impacted users, and where appropriate all users, about the vulnerability or incident and the measures they can take to reduce its impact.
Where the reports go
Notifications are submitted through the single reporting platform that Article 16 tasks ENISA, the EU cybersecurity agency, with establishing and running. The manufacturer uses the electronic notification end-point of the CSIRT designated as coordinator in the Member State of its main establishment in the Union, and the notification is simultaneously accessible to ENISA (Article 14(7)).
A manufacturer’s main establishment is where decisions on the cybersecurity of its products are predominantly taken. A manufacturer with no main establishment in the EU follows an order set out in Article 14(7): the Member State of the authorised representative acting for the highest number of its products, then that of the importer placing the most of its products on the market, then that of the distributor making the most available, and finally the Member State with the most users. For a non-EU brand selling through an EU importer, that means the importer’s country may decide which CSIRT receives the report.
Products already on the market
The detail that catches many companies out is in the transitional provisions. As a rule, products placed on the market before 11 December 2027 only fall under the CRA if they are substantially modified after that date (Article 69(2)). Article 69(3) makes an exception: the Article 14 reporting obligations apply to all in-scope products placed on the market before 11 December 2027.
So a connected product you launched in 2024 and still support is covered by the reporting duty from 11 September 2026, even though it does not need a CRA conformity assessment unless it is substantially modified from 11 December 2027.
The CRA also attaches real penalties to the duty. Under Article 64(2), non-compliance with the obligations in Article 14 can lead to administrative fines of up to EUR 15 million or, for an undertaking, up to 2.5 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.
A preparation plan for the summer
With three months to go, the work is mostly organisational:
- List every connected product you have placed on the market, including discontinued models still in use, and the software versions in the field.
- Name who is responsible for deciding, within hours, whether a report is “actively exploited” or a “severe incident”, and who sends the early warning.
- Set up an intake for vulnerability information from suppliers, researchers, customers and your own monitoring, so you know when the 24-hour clock starts.
- Map where your main establishment is, or which Member State applies under the Article 14(7) order if you are outside the EU.
- Prepare user communication templates for Article 14(8), in the languages of the markets where the product is sold.
- Agree roles with your importer or authorised representative, so information reaches the manufacturer quickly.
If your product is also radio equipment, read our Radio Equipment Directive guide and the problem pages on new cybersecurity rules for connected devices and adding Bluetooth or Wi-Fi to an existing product.
How Conphora helps
The CRA reporting duty is a deadline problem: the information you need in the first 24 hours has to be ready before anything happens. With Conphora you can:
- Keep a register of your connected products, with models, software versions, markets and the economic operators involved.
- Link each product to its responsible people and documents, so the person who must decide on a report finds everything in one place.
- Track the CRA dates per product, from the reporting duty in September 2026 to full application in December 2027.
- Store reports and user notices next to the product they concern, ready for a market surveillance request.
See how Conphora works and how it keeps product records ready for the authorities.
Want your connected products ready for 11 September? See plans and pricing →