Cyber Resilience Act: reporting obligations apply from 11 September 2026
Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, live from the same date.
From 11 September 2026 the reporting obligations of Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act) apply. The other provisions of the regulation apply from 11 December 2027.
What must be reported
- Actively exploited vulnerabilities in products with digital elements.
- Severe incidents affecting the security of those products.
Deadlines
- Early warning within 24 hours of the manufacturer becoming aware.
- Notification within 72 hours.
- Final report within 14 days of a corrective measure being available, for vulnerabilities, and within one month of the notification, for severe incidents.
How
Reports are submitted through ENISA's Single Reporting Platform, provided for by Article 16 and live since 11 September 2026. They are addressed to the CSIRT of the Member State of main establishment and, at the same time, to ENISA.
The obligations also cover products placed on the market before the regulation fully applies. For open-source software stewards (Article 24(3)) they apply from 11 December 2027.
Official sources
Information only, current as of the date shown. Not legal advice: obligations and deadlines should be checked against the official texts.