24 Hours To Report: What The Cyber Resilience Act's New Reporting Duty Means For Software And Device Makers

By Author: CA Cybersecurity Analytics
Total Articles: 8
Comment this article

24 Hours to Report: What the Cyber Resilience Act's New Reporting Duty Means for Software and Device Makers

By CA Cybersecurity Analytics · Last updated 19 October 2026
Since 11 September 2026, manufacturers of software and connected devices sold in the EU must report actively exploited vulnerabilities and severe security incidents under Article 14 of the Cyber Resilience Act (CRA). The first warning is due within 24 hours of the manufacturer becoming aware, a fuller notification within 72 hours, and a final report after that. Products already on the market are covered too.

Key Facts

• The CRA (Regulation (EU) 2024/2847) entered into force on 10 December 2024 and applies in full from 11 December 2027.
• Article 14 reporting obligations have applied since 11 September 2026, with no grace period.
• An early warning is due within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident.
• A notification follows within 72 hours. The final report is due 14 days after a fix is available (vulnerabilities) or one month after the notification ...
... (severe incidents).
• Reports are submitted through ENISA's single reporting platform to the CSIRT of the member state where the manufacturer is mainly established.

Who does the 24-hour clock apply to?

It applies to manufacturers of "products with digital elements" on the EU market: software, firmware and connected hardware, including products sold before September 2026 and products still in use after their support period ends. Manufacturers based outside the EU are covered as well.

What has to be reported, and when?

Two events start the clock: an actively exploited vulnerability in the product, or a severe incident affecting its security. The sequence is the same for both:

• 24 hours: an early warning to the CSIRT and ENISA.

• 72 hours: a notification describing the issue and any corrective or mitigating measures.

• Final report: 14 days after a fix is available for a vulnerability, or one month after the notification for a severe incident.
Manufacturers must also tell affected users what happened and what they should do.

Why is 24 hours harder than it sounds?

The clock starts when the manufacturer becomes aware, not when the investigation ends. Within a day, a team has to confirm exploitation, identify affected versions and decide who signs off. That only works with a current inventory of products and components, named decision owners and a tested route to the reporting platform. Teams that keep vulnerability, asset and incident d
ata in separate tools often lose the first hours just pulling it together.
How can manufacturers prepare now?

1. Map every product in scope and record its support period.
2. Maintain a software bill of materials linked to vulnerability feeds.
3. Write a CRA reporting runbook with owners and templates, then rehearse it.
4. Align CRA, NIS2 and GDPR reporting so one incident does not trigger three separate processes.

CA Cybersecurity Analytics , a Gdańsk-based cybersecurity and risk management company, supports this work through vulnerability assessment, cybersecurity incident response and compliance and regulatory services.
Frequently asked questions

Does the reporting duty apply to products sold before 11 September 2026?
Yes. Article 14 applies to products already on the EU market, including those placed on it before the reporting obligations started.

Is the 24-hour early warning a full report?

No. It is a short first notice. More detail follows in the 72-hour notification and the final report.

Does the CRA replace NIS2 incident reporting?

No. A company that is both a product manufacturer and an essential or important entity under NIS2 may have to meet both reporting duties.

What to do next

The CRA turns vulnerability handling into a deadline-driven process. Manufacturers that know what they ship, who decides and how to report will meet the 24-hour window. A cybersecurity risk assessment from CA is a practical place to check how ready you are.

About CA Cybersecurity Analytics

CA Cybersecurity Analytics is a cybersecurity company based in Gdańsk, Poland. Its team of experts, with over 20 years of experience, helps organisations protect their data, infrastructure and reputation through risk management, cybersecurity, data protection, compliance and AI services. Learn more at https://cyberanalytics.tech/en

CA Cybersecurity Analytics is a team of experts with over a decade of experience protecting companies’ data, infrastructure, and reputation. We help organisations of all sizes build robust Information Security Management Systems (ISMS) using risk strategies, AI/Generative AI, and streamlined cybersecurity tools tailored to each business.