From 11 September 2026 new reporting obligations under the EU’s Cyber Resilience Act (CRA) come into force, obliging manufacturers to report actively exploited vulnerabilities and severe security incidents in products with digital elements. The European Commission said the measures aim to strengthen cybersecurity across hardware and software available in the single market.
What the Commission announced
The CRA requires manufacturers to submit an early warning within 24 hours of discovering an actively exploited vulnerability or a severe incident that affects product security, followed by a full notification within 72 hours. A final report must be provided no later than 14 days after a corrective or mitigating measure is available for an actively exploited vulnerability, and within one month for a severe incident.
The reporting obligations cover all products with digital elements made available in the EU, including those already on the market. Manufacturers will use the CRA Single Reporting Platform, established and maintained by the European Union Agency for Cybersecurity (ENISA), to submit notifications. National market surveillance authorities are responsible for enforcement.
The Commission has published practical guidance intended to help manufacturers, developers and businesses comply with the new requirements. The CRA’s broader obligations—requiring products with digital elements to be designed, updated and maintained to protect users from security risks—are set to take effect later, with the main obligations applying from 11 December 2027. The CE marking will indicate products that comply with CRA requirements.
Why it matters
The rules apply to a wide range of everyday devices and software, from consumer goods such as smartwatches and baby monitors to industrial and professional products with embedded software. Faster reporting aims to shorten the time between the detection of a vulnerability or incident and the communication to authorities and the public, potentially improving the ability of users, businesses and regulators to respond.
For users, the Commission highlights that faster notifications should provide stronger protection for connected devices—examples given include door locking systems—helping maintain safety in the event of cyberattacks. For manufacturers and developers, the obligations introduce specific timelines and a centralised reporting channel that will shape incident response and disclosure practices across the EU market.
What happens next
From 11 September 2026 manufacturers must begin reporting through the CRA Single Reporting Platform whenever the new criteria are met. National market surveillance authorities will oversee compliance and enforcement. The Commission’s practical guidance is available to help stakeholders adapt procedures and reporting systems.
The CRA’s main substantive obligations on product design, maintenance and updates will enter into force on 11 December 2027, extending the regulatory framework beyond reporting to place broader responsibilities on economic operators to reduce cybersecurity risks in products with digital elements.
Source: European Commission press release
