CRA Reporting Obligations: What Applies Since 11 September 2026

Since 11 September 2026, the reporting obligations of Article 14 of the Cyber Resilience Act (CRA) apply. Manufacturers placing products with digital elements on the EU market must report actively exploited vulnerabilities and severe security incidents from that date. The deadlines are short. Teams that want to meet them need clear responsibilities and processes before the first case arrives.

The Three Deadlines at a Glance

1. Early warning within 24 hours of becoming aware. It answers the basic questions: what happened, and does it affect your products?
2. Notification within 72 hours with first details on the vulnerability or incident, your assessment, and the measures you have started.
3. Final report no later than 14 days after a corrective measure is available. For severe incidents, one month after the notification applies instead.

When the Clock Starts

The deadline starts with becoming aware of the exploitation, not when the security team opens a ticket. Reports from customers, researchers, or monitoring sources count from the moment they reach your company. Record the time of receipt, down to the hour. Anyone who sets the starting point later has to be able to justify it.

What Must Be Reported

• Actively exploited vulnerability: A flaw in your product for which there is reliable evidence that it is being exploited without authorization. A known but merely theoretical weakness is not enough.
• Severe security incident: An incident that affects, or could affect, the security of your product. When an incident counts as severe is defined in the legal text. Check your case against it rather than deciding by gut feeling.

Where Reports Go

Reports are submitted through a central reporting platform operated by the EU Agency for Cybersecurity (ENISA). They go to the responsible CSIRTs or authorities. Find out early which body is responsible for your registered office and your markets.

Practical Checklist

• Define roles: Who assesses? Who reports? Who approves? Who informs customers?
• Record intake channels: Customer reports, researcher disclosures, monitoring, and threat intelligence, each with a timestamp.
• Prepare templates for the early warning, the 72-hour notification, and the final report.
• Clarify communication: How and when do you inform customers?
• Secure deadlines: Store them in your ticketing system or tool, with automatic reminders.
• Practice: A tabletop exercise with a 24-hour deadline quickly shows where things break.

Keeping the Effort Manageable: Secvisory

The checklist can be worked through by hand, but in a real case it costs time and nerves. Secvisory takes over a large part of this work:

• The platform calculates the deadlines. Starting from the recorded moment of awareness, Secvisory calculates all deadlines, reminds you in time, and prepares notification drafts. Changes to the timestamp require a reason.
• Approvals run in a structured way. Four-eyes approval is built in. Responsible people can see at any time where a case stands.
• Publication is automated. After each approval, signed advisory files and updated feeds are created that customers and aggregators can find.

That way your team focuses on the substance instead of tracking deadlines in its head or in spreadsheets.

Conclusion

The deadlines are tight but manageable if your processes are in place before the emergency. If you define roles, timestamps, and templates now, you will not have to decide what to do in the moment. You can simply act.

Want to see how a CRA case runs in Secvisory, from awareness to notification? In 30 minutes we will walk you through the process using an example from your own context. Get in touch via our contact page, and we will reply within one business day.