In brief
From 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents through the single reporting platform (ENISA): an early warning within 24 hours, a notification within 72 hours and a final report. The obligation also applies to products placed on the market before 11 December 2027.
What has to be reported?
- Actively exploited vulnerabilities in a product with digital elements – vulnerabilities for which there is reliable evidence that they have been exploited.
- Severe incidents affecting the security of the product.
The obligation lies with the manufacturer, regardless of whether it discovered the vulnerability itself or someone else reported it.
Within which deadlines?
| Step | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | within 24 hours of becoming aware | within 24 hours of becoming aware |
| Notification | within 72 hours of becoming aware | within 72 hours of becoming aware |
| Final report | no later than 14 days after a corrective or mitigating measure is available | within one month of the notification |
Where are reports submitted?
Through the single reporting platform operated by ENISA. The report goes to the CSIRT designated as coordinator for coordinated vulnerability disclosure in the Member State of the manufacturer's main establishment in the EU, and is simultaneously accessible to ENISA (Article 14(7)). For manufacturers established in Slovenia, this is SI-CERT. The main establishment is in the Member State where decisions on the cybersecurity of products are predominantly taken; if this cannot be determined, in the Member State with the most employees in the EU.
Does it also apply to products already on the market?
Yes. Under Article 69(3), the reporting obligation applies to all in-scope products with digital elements placed on the market before 11 December 2027. Manufacturers therefore need to know their older products and the components in them as well.
Do users have to be informed?
Yes. After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer must inform the affected users – where necessary, all users – and tell them about mitigation and corrective measures, where appropriate in a structured, machine-readable format. If the manufacturer does not inform users in a timely manner, the CSIRT that received the notification may inform them (Article 14(8)).
What do you need internally?
Contact point
A published address for reporting vulnerabilities, for example in a
security.txtfile.Triage
A procedure for deciding whether a vulnerability is actively exploited or an incident is severe – with roles and deputies, so the 24- and 72-hour deadlines hold during holidays too.
Coordinated vulnerability disclosure (CVD) policy
How you receive reports, communicate with the reporter and publish the fix.
Software bill of materials (SBOM)
Without it you do not know which products are affected when a vulnerability in a component is published.
Report templates and an exercise
Prepared content for the early warning, notification and final report, and a test of the procedure.
For industrial products, a link to IEC 62443-4-1 makes sense; for the organisation, to ISO/IEC 27001 (A.8.8, A.8.25–A.8.29).
What are the penalties?
For infringements of the obligations in Article 14 (reporting) and Article 13 and of the essential requirements: up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher (Article 64).
Frequently asked questions
When does the CRA reporting obligation apply?
From 11 September 2026. It also applies to products with digital elements placed on the market before 11 December 2027 (Article 69(3)).
Does every vulnerability have to be reported?
No. The reporting obligation applies to actively exploited vulnerabilities and to severe incidents affecting the security of the product. Other vulnerabilities are handled through the manufacturer's vulnerability handling process and coordinated disclosure policy.
Where are reports submitted?
Through the single reporting platform operated by ENISA, to the CSIRT designated as coordinator for coordinated vulnerability disclosure in the Member State of the manufacturer's main establishment in the EU. For manufacturers established in Slovenia, this is SI-CERT.
Sources
- Regulation (EU) 2024/2847 (CRA), Articles 13, 14, 64 and 69 – EUR-Lex
- gov.si – Coordinated vulnerability disclosure and the European vulnerability database (1 July 2025, in Slovenian)
Last updated: · Prepared by the Regulus Ai team
Do you need a vulnerability reporting process that meets the 24- and 72-hour deadlines?
Book an initial consultation