At a glance
- The reporting obligation under Art. 14 CRA has applied since 11 September 2026, all other obligations apply from 11 December 2027.
- Reports are due for actively exploited vulnerabilities and severe incidents having an impact on the product.
- Deadlines from awareness: early warning within 24 hours, notification within 72 hours. The final report follows 14 days after a fix (vulnerability) or one month after the notification (incident).
- Reports go through the ENISA Single Reporting Platform to the CSIRT in the country of the main establishment, for Germany the BSI (Germany’s Federal Office for Information Security).
- The obligation also covers products placed on the market before 2027. Breaches of Art. 14 can be fined up to EUR 15 million or 2.5% of worldwide annual turnover.
Since when the reporting obligation applies
Regulation (EU) 2024/2847 entered into force on 10 December 2024. It applies in stages: Chapter IV on conformity assessment bodies since 11 June 2026, Article 14 with the reporting obligations since 11 September 2026 and all other requirements from 11 December 2027 (Art. 71(2)).
The reporting obligation is therefore the first CRA obligation that manufacturers feel in day-to-day work. It requires no conformity assessment and no CE marking under the CRA. It does require a process that detects exploitation and responds within hours.
Who the obligation applies to
The obligation applies to the manufacturer: anyone who develops or manufactures a product with digital elements, or has it designed, developed or manufactured, and markets it under their own name or trademark, whether for payment or free of charge (Art. 3(13)).
A product with digital elements is a software or hardware product together with its remote data processing solutions (Art. 3(1)). It is in scope if its intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Art. 2(1)).
Machines and plants
Machines are not exempt. A machine with a controller and a data connection, for example via network, fieldbus, remote maintenance or USB, has the characteristics of a hardware product with a data connection. The Commission’s guidance expressly treats machines as products with digital elements. Complex systems made up of several hardware and software elements and placed on the market as one product are also covered; long development cycles do not change this. Each case still has to be checked individually.
Exemptions
Exemptions include medical devices and in vitro diagnostic medical devices, type-approved motor vehicles, certified aeronautical products, marine equipment, identical spare parts and products developed exclusively for national security or defence (Art. 2(2) to (7)). Certain L-category vehicles have their own exemption under Delegated Regulation (EU) 2025/1535.
What has to be reported
Article 14 covers two triggers:
- Actively exploited vulnerability (Art. 14(1)): a vulnerability in the product for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner (Art. 3(42)). More on the page Actively exploited vulnerability.
- Severe incident (Art. 14(3) and (5)): an incident that negatively affects or is capable of negatively affecting the ability of the product to protect sensitive or important data or functions, or that has led or is capable of leading to the introduction or execution of malicious code in the product or in the user’s systems. The recitals give as an example malicious code introduced into the release channel for security updates.
A vulnerability discovered without malicious intent during testing, investigation or good-faith disclosure is not subject to mandatory reporting (Recital 68). It can be reported voluntarily under Art. 15; the ENISA platform does not yet offer a function for this.
The deadlines at a glance
- Hour 0AwarenessInitial assessment shows active exploitation with a reasonable degree of certainty.
- within 24 hoursEarly warning notificationMember states in which the product has been made available.
- within 72 hoursVulnerability notificationProduct, nature of the exploit, measures, information for users.
- 14 days after a fixFinal reportSeverity, impact, malicious actor, security update.
- Hour 0AwarenessIncident has an impact on the security of the product.
- within 24 hoursEarly warning notificationSuspicion of unlawful or malicious acts.
- within 72 hoursIncident notificationNature of the incident, initial assessment, measures.
- 1 month after notificationFinal reportRoot cause, threat, mitigation applied.
All deadlines start once the manufacturer becomes aware. The CRA contains no legal definition of this. The Commission takes it to mean the moment at which an initial assessment, carried out without undue delay, establishes with a reasonable degree of certainty that a vulnerability is being actively exploited or that a severe incident has affected the security of the product. Delaying the initial assessment therefore does not delay the deadline.
Important for planning: the 14 days for the final report run from the time a corrective or mitigating measure is available. For an incident, the month runs from the 72-hour notification. The countdown on the ENISA platform currently shows the 72-hour notification as due 48 hours after the early warning; the statutory deadline from awareness is what counts.
Stop counting deadlines by hand
Fixradar matches your SBOMs every day, detects actively exploited vulnerabilities and prepares the early warning, notification and final report for the ENISA platform.
What goes into each report
| Stage | Vulnerability (Art. 14(2)) | Incident (Art. 14(4)) |
|---|---|---|
| Early warning 24 hours | Member states in which, to the manufacturer’s knowledge, the product has been made available | Whether unlawful or malicious acts are suspected; where applicable, the member states in which the product has been made available |
| Notification 72 hours | General information about the product, general nature of the exploit and of the vulnerability, corrective or mitigating measures taken, measures users can take, on request an indication of how sensitive the information is | Nature of the incident, initial assessment, measures taken, measures for users, on request an indication of how sensitive the information is |
| Final report | No later than 14 days after a fix is available: description including severity and impact, where available information on the malicious actor, details of the security update | Within one month of the notification: detailed description including severity and impact, type of threat or root cause, mitigation applied and ongoing |
The CSIRT may also request an intermediate report with relevant status updates (Art. 14(6)). No implementing act on the format of notifications under Art. 14(10) has been adopted so far. The fields requested currently follow from the glossary and the user manual of the ENISA platform; for vulnerabilities they include the CVE and EUVD identifiers, severity, malicious actor and type of exploit.
Who receives the report
Reports go through the ENISA Single Reporting Platform (Art. 16). The report goes to the CSIRT designated as coordinator in the member state of the main establishment and is accessible to ENISA at the same time (Art. 14(7)). The main establishment is the member state where decisions on the cybersecurity of the products are predominantly taken.
For Germany, the competent body is the BSI with CERT-Bund. According to the BSI, it has been coordinating CRA reports since 11 September 2026. A manufacturer with several establishments in the EU submits only one report per event. How registration and reporting work in practice on the platform is explained on the page Reporting through the ENISA Single Reporting Platform.
Informing users
In addition to the report to the authorities, the manufacturer informs the impacted users and, where appropriate, all users about the vulnerability or incident and about measures they can take, where appropriate in a structured, machine-readable format (Art. 14(8)). The text sets no fixed deadline in hours; the information has to be provided in a timely manner. If it is not, the CSIRTs may inform the users themselves.
The Commission interprets the obligation on a risk basis: it does not require public disclosure. For products used in sensitive environments, detailed information can be limited to affected customers. Machine-readable formats for such notices include VEX documents and security advisories in CSAF format.
Machines in the field and legacy products
An important exception to the transitional rule applies to existing products: the Art. 14 obligations apply to all in-scope products placed on the market before 11 December 2027 (Art. 69(3)). A machine from 2019 with remote maintenance has therefore been subject to reporting since September 2026 if it contains an actively exploited vulnerability. According to the Commission, this also applies after the end of the support period.
Nothing is reported retroactively: if the manufacturer already knew about the active exploitation before 11 September 2026, there is no obligation to report. If the manufacturer only learns of it afterwards, a report is due, even if the vulnerability itself had been known for longer.
Fines and German implementation
Breaches of Art. 13 and 14 and of the requirements in Annex I can be fined up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)). The amount takes into account, among other things, gravity, duration and company size. Art. 64(10) provides an exception for microenterprises and small enterprises that miss the 24-hour deadline; the wording leaves unclear how far it reaches.
In Germany, the Bundestag (the federal parliament) passed the CRA Implementation Act on 15 October 2026. It amends the BSI Act: the BSI becomes market surveillance authority, notifying authority and the authority for fines, and performs the tasks of a CSIRT. In the version recommended by the committee, market surveillance and the provisions on fines enter into force on 11 December 2027. The second reading in the Bundesrat (the chamber of the federal states) and promulgation were still pending in early November 2026. The reporting obligation itself applies directly from the Regulation regardless.
How to prepare
- Record your products: Which machines and devices with a data connection are on the EU market, in which firmware versions, in which countries?
- Build SBOMs: Without a software bill of materials (SBOM) you cannot tell whether an exploited vulnerability is in your own product. See SBOM under the CRA.
- Monitor sources: Regularly match notices from customers, partners and authorities as well as public catalogues of exploited vulnerabilities (such as CISA KEV and ENISA’s EUVD) against your own SBOMs.
- Clarify responsibilities: Who assesses, who reports, who stands in? The ENISA platform requires a registered representative with EU Login.
- Prepare texts and evidence: Early warning, notification and final report have to be available in English and in the platform’s field structure; every decision should be documented in a traceable way.
Frequently asked questions
Does the CRA reporting obligation already apply, even though the CRA only applies in 2027?
Yes. Art. 71(2) brings Art. 14 forward to 11 September 2026. Since then, actively exploited vulnerabilities and severe incidents have to be reported.
Do I also have to report for machines that have already been delivered?
Yes. Under Art. 69(3), the Art. 14 obligations also apply to products placed on the market before 11 December 2027.
When does the 24-hour deadline start?
When the manufacturer becomes aware. According to the Commission’s guidance, this is the case as soon as an initial assessment, carried out without undue delay, shows active exploitation with a reasonable degree of certainty.
Who do German manufacturers report to?
Through the ENISA Single Reporting Platform to the CSIRT in the country of the main establishment. For Germany, the BSI (Federal Office for Information Security) with CERT-Bund is designated.
Do I have to report every vulnerability in my product?
No. Reporting is mandatory for actively exploited vulnerabilities. Vulnerabilities found during testing or by researchers in good faith, without evidence of malicious exploitation, are not subject to mandatory reporting.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex
- European Commission: Guidance on the application of Regulation (EU) 2024/2847, C(2026) 5252 (27 July 2026)
- European Commission: FAQs on the Cyber Resilience Act, version 1.4 (4 September 2026)
- ENISA: CRA Single Reporting Platform, Frequently Asked Questions (15 October 2026)
- ENISA: List of CSIRTs designated as coordinators
- BSI: CRA Implementation Act adopted (16 October 2026) (in German)
- German Bundestag, DIP: Act implementing Regulation (EU) 2024/2847 (in German)
As of: November 2026. This page reflects the general legal position and is not legal advice for individual cases.