Overview
Effective September 11, 2026, manufacturers of in-scope products with digital elements will be subject to incident and vulnerability reporting requirements under the EU Cyber Resilience Act (CRA). The CRA established a new EU-wide, product-focused cybersecurity framework, shifting regulatory attention beyond an organization's corporate network and cloud environment to the cybersecurity of the hardware, software, firmware, and connected products that companies place on the EU market. Specifically, the CRA establishes harmonized EU rules for placing connected hardware and software products on the market, imposes mandatory cybersecurity requirements on those products, and creates corresponding obligations for every actor across the value chain. While most CRA obligations will not enter into application until December 11, 2027, this incident and vulnerability reporting requirement is one of the first to take effect.
I. Mandatory Vulnerability and Incident Reporting Begins September 11, 2026
Manufacturers of covered products must submit an early warning notification without undue delay and, in any event, within 24 hours of becoming aware of either an actively exploited vulnerability contained in a product with digital elements or a severe incident having an impact on the security of a product with digital elements, effective September 11, 2026.
Notifications are to be submitted through the CRA's Single Reporting Platform (SRP). The platform is intended to make reports available to the European Union Agency for Cybersecurity (ENISA) and the relevant national Computer Security Incident Response Team (CSIRT). The relevant CSIRT will generally depend on the Member State of the manufacturer's main establishment in the EU or, for a non-EU manufacturer, the establishment of its authorized representative.
Manufacturers must then submit a more detailed vulnerability or incident notification within 72 hours of becoming aware of the actively exploited vulnerability or severe incident. This notification must include the information required by the CRA to the extent it is available at that time.
Manufacturers must also submit a final report:
- for a severe incident, generally within one month after submitting the 72-hour notification; and
- for an actively exploited vulnerability, no later than 14 days after a corrective or mitigating measure becomes available.
These deadlines may run before an organization has completed its root-cause analysis, identified all affected customers, or deployed a complete remediation. Companies should therefore establish procedures that permit rapid preliminary reporting while technical and legal investigations continue.
The reporting obligation is particularly significant because it can apply to in-scope products already on the EU market when the September 2026 reporting rules take effect. This obligation should be distinguished from the CRA's broader conformity and CE-marking requirements, which generally apply from December 2027 to products placed on the EU market from that date, subject to the CRA's transitional rules.
II. Penalties for Failure to Report
Failure to comply with the CRA's reporting obligations can result in significant administrative fines. The CRA requires Member States to establish penalties that are effective, proportionate, and dissuasive.
For serious violations, including failures to comply with manufacturer obligations that include the CRA's Article 14 vulnerability and incident reporting requirements, penalties may reach up to €15 million or 2.5% of the offender's total worldwide annual turnover for the preceding financial year, whichever is higher.
The specific enforcement approach and penalty imposed will depend on the Member State and the circumstances of the violation, including its nature, gravity, duration, and any corrective actions taken. Companies should therefore treat the CRA's 24-hour and 72-hour reporting deadlines as regulatory requirements requiring documented escalation, assessment, and decision-making processes—not merely as voluntary cybersecurity best practices.
III. CRA Reporting May Overlap With NIS2, GDPR, and Other Regimes
A CRA-reportable vulnerability or incident may also trigger notification obligations under other EU cybersecurity, operational-resilience, privacy, and sector-specific regimes. A report made under the CRA will not necessarily satisfy obligations under other applicable EU law, such as the Network and Information Security Directive (NIS2), the General Data Protection Regulation (“GDPR”), ePrivacy Directive, the Digital Operational Resilience Act (DORA), or national law, and contractual commitments.
The legal triggers, recipients, deadlines, and content requirements under these regimes are not identical. A severe product-security incident may be reportable under the CRA even if no personal data is involved. Conversely, a personal-data breach may trigger GDPR notification requirements even if it does not meet the CRA threshold for reporting a severe incident. Similarly, an in-scope entity may have a separate NIS2 reporting obligation where an incident materially affects the provision of its services.
IV. A Shift Toward Product-Focused Cybersecurity Regulation
The CRA applies broadly to products with digital elements—that is, certain hardware and software products intended to have a direct or indirect data connection to a device or network. Covered products may include:
- connected consumer and industrial devices;
- network equipment and embedded systems;
- software applications and operating systems;
- security products and components;
- Internet of Things (IoT) products; and
- certain remote data-processing solutions that are necessary for a product to perform its intended functions.
The CRA's central focus is cybersecurity throughout a product's lifecycle. Among other requirements, manufacturers must address cybersecurity risks, handle vulnerabilities, provide security updates, prepare and maintain required documentation, and support products during their applicable support periods.
These obligations differ from traditional cybersecurity and data-protection requirements, which often focus on the protection of a company's internal systems, enterprise network, or personal data. Under the CRA, a vulnerability in a sold product can create regulatory consequences even where the manufacturer's own corporate environment has not been compromised.
The distinction should not be treated as absolute. A security incident involving a manufacturer's cloud or hosted environment may implicate the CRA where the affected remote service is necessary for a covered product to perform its intended functions or where the incident affects the security of the product.
The CRA does not apply uniformly to every digital product or service. Its scope is subject to exclusions and interactions with sector-specific EU regimes, as well as rules concerning certain open-source software and remote data-processing services. Product-specific analysis is therefore necessary.
V. Cybersecurity Assessments and Conformity Requirements Begin in 2027
Beginning December 11, 2027, manufacturers generally will be required to comply with the CRA's broader product requirements before placing covered products on the EU market. These requirements include conducting and documenting cybersecurity risk assessments, maintaining those assessments throughout the applicable support period, and demonstrating conformity with the CRA's essential cybersecurity requirements.
Manufacturers will generally need to:
- conduct and document a product-specific cybersecurity risk assessment;
- implement vulnerability-handling and security-update processes;
- prepare technical documentation;
- complete the applicable conformity-assessment procedure;
- issue an EU Declaration of Conformity; and
- affix the CE marking before placing a covered product on the EU market.
The applicable conformity-assessment procedure depends on the product's classification and the extent to which the manufacturer applies relevant harmonized standards or common specifications.
Many products may be assessed through an internal-control procedure. However, certain important and critical products may require a more demanding conformity-assessment route, including notified-body involvement and, in some circumstances, an EU cybersecurity certificate.
The CRA's full conformity regime generally applies to products placed on the EU market beginning December 11, 2027. Products placed on the market before that date are generally subject to transitional treatment, although substantial modifications after that date can bring a product within the broader CRA requirements.
VI. Importer and Distributor Obligations
Beginning in December 2027, importers and distributors will have distinct verification and due-diligence obligations.
Importers must generally ensure, before placing a product on the EU market, that the manufacturer has completed the applicable conformity assessment and that required technical documentation, CE marking, product information, and other required materials are in place.
Distributors must verify specified visible and accompanying compliance elements, including CE marking and required information and instructions. They must not make products available where they know or have reason to believe that a product is noncompliant.
Both importers and distributors may be required to take corrective action, cooperate with market-surveillance authorities, and provide information or documentation necessary to address cybersecurity risks associated with products they have placed or made available on the market.
VII. What Companies Should Do Now
Organizations that manufacture, import, or distribute products with digital elements in the EU should begin preparing now for the September 2026 reporting deadline and the broader December 2027 compliance milestone.
Manufacturers should revise incident-response playbooks, escalation procedures, and decision-making structures so they can identify potentially reportable actively exploited vulnerabilities and severe incidents affecting covered products. This includes assigning responsibility for assessing reportability, coordinating technical, legal, privacy, and regulatory review, and preparing notifications within the CRA's 24- and 72-hour reporting windows.
Incident-response procedures should also account for potentially parallel notification duties under other EU law, national law, contractual commitments, and sector-specific requirements. Because the reporting triggers, deadlines, recipients, and required content under those regimes differ, companies should develop a coordinated process for assessing and managing cross-regulatory reporting obligations following a significant cybersecurity event.
Companies should consider engaging counsel to direct a cybersecurity assessment of products made available on the EU market, including product scope and classification, existing security controls, vulnerability-management processes, SBOM practices, and security-update capabilities. Preparing now will also position manufacturers for the CRA's broader compliance milestone on December 11, 2027, when manufacturers generally must conduct and document a product-specific cybersecurity risk assessment before placing a covered product on the EU market and keep that assessment current throughout the product's support period.
Manufacturers must then complete the applicable conformity-assessment procedure, prepare technical documentation, issue an EU Declaration of Conformity, and affix CE marking. While many products may be assessed through internal controls, certain important and critical products may require notified-body involvement or an EU cybersecurity certificate, depending on the product's classification and the applicable standards or common specifications.
VIII. Key Takeaway
The CRA's September 2026 reporting obligations mark an important development in EU cybersecurity regulation. For companies placing connected products, software, and other products with digital elements on the EU market, cybersecurity is no longer solely a matter of protecting corporate infrastructure and sensitive information. Product cybersecurity—secure-by-design development, vulnerability handling, security updates, and lifecycle support—is becoming a condition of access to the EU market.
