Cyber Resilience Act reporting: the 24-hour and 72-hour rules

Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents under Article 14 of the Cyber Resilience Act. An early warning is due within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report later.

Key points

• Article 14 reporting has applied since 11 September 2026. The Regulation applies in full from 11 December 2027.
• There are two triggers: an actively exploited vulnerability in your product, or a severe incident that affects the security of your product.
• Both follow a staged path: early warning (24 hours), notification (72 hours), then a final report. The final report's deadline differs for vulnerabilities and incidents.
• Reports go through a single reporting platform, simultaneously to a national CSIRT (computer security incident response team) and to ENISA, the EU cybersecurity agency.
• Manufacturers outside the EU are covered if they make products available on the EU market.

When did CRA reporting start, and what is still to come?

The Cyber Resilience Act (Regulation (EU) 2024/2847) is being phased in. Article 71 sets the dates. Chapter IV, on the notification of conformity assessment bodies, applied from 11 June 2026. The reporting duties in Article 14 applied from 11 September 2026. The Regulation as a whole applies from 11 December 2027.

For most manufacturers, reporting is the first duty that applies directly to them, because Chapter IV concerns conformity assessment bodies, not manufacturers. The design, documentation and conformity requirements for products follow from 11 December 2027.

Who has to report?

Article 14 places the duty on the manufacturer. Article 3 defines a manufacturer as a person who develops or manufactures a product with digital elements, or has it designed, developed or manufactured, and markets it under their own name or trademark. The definition applies whether the product is supplied for payment, monetised in another way, or free of charge. It does not depend on where the company is established.

The Act covers products with digital elements. These are software or hardware products, and their remote data processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Connected devices, embedded software and many apps fall within this description. The Act applies to products made available on the market, meaning supplied in the course of a commercial activity (Article 3), so free software supplied outside a commercial activity may fall outside it. Article 2 also lists exclusions, such as some products regulated under other EU law, so scope should be checked product by product.

Article 69(3) applies the Article 14 reporting duties to in-scope products placed on the market before 11 December 2027, not only to new ones.

What exactly must be reported?

There are two triggers.

Actively exploited vulnerabilities. Article 3 defines these as vulnerabilities for which there is reliable evidence that a malicious actor has exploited them in a system without the permission of the system's owner. Under Article 14(1), the duty arises when the manufacturer becomes aware of such a vulnerability in its product.

Severe incidents. Under Article 14(3), the duty covers a severe incident that has an impact on the security of the product. An incident is treated as severe where either of the two conditions in Article 14(5) is met:

• it negatively affects, or is capable of negatively affecting, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or
• it has led, or is capable of leading, to the introduction or execution of malicious code in the product or in the network and information systems of a user.

What are the deadlines?

Each trigger has three stages. The clock for the first two stages starts when the manufacturer becomes aware.

In summary, as set out in Article 14(2) for vulnerabilities and Article 14(4) for incidents:

• Early warning: without undue delay and in any event within 24 hours of becoming aware. It indicates, where applicable, the Member States in which the manufacturer knows the product has been made available. For an incident, it also indicates whether the incident is suspected of being caused by unlawful or malicious acts.
• Notification: without undue delay and in any event within 72 hours of becoming aware, unless the relevant information has already been provided. For a vulnerability, it gives general information about the product, the general nature of the exploit and the vulnerability, and the corrective or mitigating measures taken. For an incident, it gives the general nature of the incident, an initial assessment, and the corrective measures taken. Both also cover mitigating measures that users can take.
• Final report: for a vulnerability, no later than 14 days after a corrective or mitigating measure is available. For an incident, within one month after the submission of the incident notification.

The final vulnerability report describes the vulnerability, its severity and impact, any available information about the malicious actor, and the security update or other corrective measures made available. The final incident report gives a detailed description of the incident, the type of threat or likely root cause, and the mitigation measures applied and ongoing.

Where do reports go, and who else must be told?

Article 14(1) and (3) require each notification to be sent simultaneously to the CSIRT designated as coordinator and to ENISA. Notifications are made through the single reporting platform provided for in Article 16. Because the practical arrangements can change, check the current ENISA and national CSIRT guidance on how to access the platform, and on any interim arrangements, before relying on a particular process.

Article 14(7) sets out how the coordinating CSIRT is identified. It is generally the CSIRT of the Member State where the manufacturer has its main establishment in the EU, meaning where decisions on the cybersecurity of its products are predominantly taken. The provision contains fallback rules where there is no such establishment, and it should be read in full.

The manufacturer also has a duty to users. Article 14(8) requires it to inform impacted users, and where appropriate all users, about an actively exploited vulnerability or a severe incident, and about any risk mitigation or corrective measures they can take.

How does this compare with NIS2 reporting?

The timings resemble those in Article 23(4) of the NIS2 Directive (Directive (EU) 2022/2555): an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report not later than one month after the submission of the incident notification. NIS2 also provides for an intermediate report on request of the CSIRT or competent authority, and for a progress report where an incident is still ongoing at the time of the final report.

The two regimes are separate. NIS2 applies to entities within its scope and concerns significant incidents. The Cyber Resilience Act applies to manufacturers and concerns their products. A company that makes connected products and also falls within NIS2 may therefore face both, from the same event.

What does good practice look like?

The following points are general good practice, not requirements of the Act:

• Decide in advance who in the company can determine that the business has "become aware", and record the time when that happens, because the 24-hour period runs from awareness.
• Keep a product inventory showing which Member States each product is sold in, since the early warning asks for this where applicable.
• Prepare templates for the three stages and a draft user communication, so the first 24 hours are not spent writing from scratch.
• Agree how security researchers and customers report vulnerabilities, and how those reports reach the person who decides on reporting.
• Align CRA and NIS2 processes where both apply, while keeping separate decision records for each regime.

Common questions

Does the reporting duty cover products already on the market? Yes. Article 69(3) applies the Article 14 obligations to in-scope products with digital elements placed on the market before 11 December 2027, as well as to later ones. Other requirements of the Act follow their own transitional rules in Article 69.

Does a non-EU manufacturer have to report? Yes, if it makes products with digital elements available on the EU market. The Act's definition of manufacturer does not depend on where the company is established. Article 14(7) also contains rules for identifying the coordinating CSIRT, which should be read for manufacturers with no main establishment in the EU.

Is a vulnerability that has not been exploited reportable under Article 14? Not under the Article 14 trigger, which concerns actively exploited vulnerabilities. Article 15 provides a separate route for voluntary notification of other vulnerabilities. The vulnerability-handling requirements in Annex I apply to in-scope products from 11 December 2027, subject to the transitional rules in Article 69.

General information, not legal advice. Prepared with AI assistance and checked against the official sources cited. Laws change; check the date above.