Cyber Resilience Act knowledge
What manufacturers of machines and devices have had to report since September 2026, how reporting to ENISA works and what role the software bill of materials plays. Checked against the text of the Regulation, Commission guidance, ENISA and the BSI (Germany’s Federal Office for Information Security). As of November 2026.
CRA reporting obligation: who must report what, and by whenEarly warning within 24 hours, notification within 72 hours, final report. What Art. 14 requires, for which products and through which route.Read moreReporting through the ENISA Single Reporting Platform step by stepLive since 11 September 2026: access with EU Login, roles of the representatives, choice of CSIRT and how a report runs on the Single Reporting Platform.Read moreActively exploited vulnerability: when the reporting obligation appliesThe definition in Art. 3(42), the start of the deadline, zero-days, bug bounty findings and vulnerabilities in supplier components.Read moreSBOM under the CRA: what the software bill of materials has to deliverMandatory from December 2027, needed today: requirements from Annex I, formats, the BSI guideline and the route to an SBOM for each firmware version.Read more