The Cyber Resilience Act reporting obligations started on 11 September 2026. Since that date, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products through ENISA's Single Reporting Platform: an early warning within 24 hours, a notification within 72 hours, then a final report. Most other obligations of the Regulation apply from 11 December 2027.
The Cyber Resilience Act (CRA) is an EU regulation, Regulation (EU) 2024/2847 of 23 October 2024. It sets horizontal cybersecurity requirements for hardware and software "products with digital elements" made available on the EU market, and it applies in stages. This page lists each date, what applies, the article that sets it and who is concerned, then the state of the implementing acts, the harmonised standards and the 2025-2026 proposals.
What are the key dates of the Cyber Resilience Act?
| Date | What applies | Article | Who is concerned |
|---|---|---|---|
| 20 November 2024 | Publication in the Official Journal (OJ L, 2024/2847) | Art. 71(1) | All economic operators |
| 10 December 2024 | Entry into force (twentieth day after publication); no obligation applies yet | Art. 71(1) | All economic operators |
| 21 December 2025 | Implementing Regulation (EU) 2025/2392 enters into force: technical description of the important (Annex III) and critical (Annex IV) product categories | Art. 7(4) | Manufacturers of important and critical products |
| 10 May 2026 | Delegated Regulation (EU) 2026/881 enters into force: conditions under which a coordinating CSIRT may delay passing on a notification | Art. 14(9), Art. 16(2) | CSIRTs; manufacturers asking for a delay |
| 11 June 2026 | Chapter IV applies: notifying authorities and notification of conformity assessment bodies | Art. 35 to 51, Art. 71(2) | Member States, conformity assessment bodies |
| 27 July 2026 | Commission guidance C(2026) 5252 published (non-binding) | Art. 26 | Manufacturers, in particular SMEs |
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents via the Single Reporting Platform, including for products already on the market | Art. 14, Art. 16, Art. 69(3) | Manufacturers, and importers or distributors treated as manufacturers |
| 11 December 2026 | Member States shall strive to have enough notified bodies to avoid bottlenecks | Art. 35(2) | Member States |
| 30 October 2027 | Deadline for the last 13 horizontal standards and for the final report of the standardisation bodies | Decision C(2025) 618 | CEN, CENELEC, ETSI |
| 11 December 2027 | Full application: essential requirements (Annex I), conformity assessment, CE marking, obligations of importers, distributors and open-source software stewards, market surveillance | Art. 71(2) | Manufacturers, importers, distributors, authorised representatives, open-source software stewards |
| 11 June 2028 | End of validity of EU type-examination certificates and approvals issued under other legislation for cybersecurity requirements | Art. 69(1) | Manufacturers of products covered by other harmonisation legislation |
| 11 September 2028 | Commission report on the effectiveness of the Single Reporting Platform | Art. 70(2) | Commission, ENISA, CSIRTs |
Two transitional rules matter in practice. Products placed on the market before 11 December 2027 are subject to the CRA requirements only if they undergo a substantial modification after that date (Article 69(2)). The reporting obligations are the exception: Article 69(3) applies Article 14 to every in-scope product already on the market, whatever its date of placing on the market.
What exactly must manufacturers report, and when?
Article 14 creates two parallel reporting tracks. Both start when the manufacturer "becomes aware" of the event, and both go through the same platform.
| Step | Actively exploited vulnerability (Art. 14(1)-(2)) | Severe incident affecting product security (Art. 14(3)-(4)) |
|---|---|---|
| Early warning | Within 24 hours; Member States where the product is made available, where known | Within 24 hours; whether unlawful or malicious acts are suspected; Member States concerned, where known |
| Notification | Within 72 hours; general information on the product, nature of the exploit and of the vulnerability, corrective or mitigating measures taken and those users can take, sensitivity of the information | Within 72 hours; nature of the incident, initial assessment, corrective or mitigating measures taken and those users can take, sensitivity of the information |
| Final report | No later than 14 days after a corrective or mitigating measure is available; description, severity and impact, information on any malicious actor, details of the security update | Within one month after the incident notification; detailed description, severity and impact, likely type of threat or root cause, applied and ongoing mitigation measures |
Further points of Article 14:
- An incident is severe when it negatively affects, or can affect, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or when it has led or can lead to malicious code in the product or in a user's systems (Art. 14(5)).
- The coordinating CSIRT may ask for an intermediate report on status updates (Art. 14(6)).
- The manufacturer must also inform the impacted users, and where appropriate all users, of the vulnerability or incident and of the mitigation measures they can deploy (Art. 14(8)).
- The notification goes to the CSIRT designated as coordinator of the Member State of the manufacturer's main establishment, meaning the place where cybersecurity decisions on its products are mainly taken. Manufacturers without a main establishment in the Union follow the order set in Article 14(7): authorised representative, importer, distributor, then users.
- Under Article 64(10), the administrative fines do not apply to micro and small manufacturers for missing the 24-hour early-warning deadline, nor to open-source software stewards.
How does the Single Reporting Platform work?
The Single Reporting Platform is the system ENISA set up under Article 16 to receive CRA notifications. ENISA launched it on 11 September 2026 as an "initial operating capability", and mandatory notifications must go through it. The manufacturer files once: the report reaches the coordinating CSIRT and ENISA at the same time, and the CSIRT then passes it on to the CSIRTs of the other Member States where the product is available. In exceptional cases, dissemination can be delayed on justified cybersecurity grounds (Art. 16(2)), under the conditions of Delegated Regulation (EU) 2026/881. ENISA publishes the user guidance, the list of coordinating CSIRTs and the platform status on its SRP page.
Where do the harmonised standards stand?
The Commission's standardisation request C(2025) 618 of 3 February 2025 asks CEN, CENELEC and ETSI for 41 standards: 15 horizontal and 26 product-specific (vertical). The decision sets three deadlines:
- 30 August 2026: two horizontal standards, one on designing, developing and producing products according to risk, and one on vulnerability handling.
- 30 October 2026: the 26 vertical standards for important and critical product categories.
- 30 October 2027: the other 13 horizontal standards, plus the final joint report.
A standard gives a presumption of conformity only once its reference is published in the Official Journal (Article 27(1)). The Commission's CRA standardisation page, last updated on 31 July 2026, did not list any cited standard. Until citations appear, manufacturers should document how they meet Annex I directly. The Commission's implementation calendar also plans a delegated act in the fourth quarter of 2026 on the presumption of conformity for products certified under the EU Common Criteria scheme (EUCC).
Did the Digital Omnibus change the CRA dates?
No. The Digital Omnibus proposal of 19 November 2025 (COM(2025) 837) does not change the CRA's dates or Article 14. It would ask ENISA to build a single entry point for incident reporting under NIS2, the GDPR, DORA, eIDAS and the CER Directive, which may build on the CRA Single Reporting Platform. It would also amend NIS2 so that a manufacturer's CRA severe-incident report counts as NIS2 reporting where it contains the required information. This text is still a proposal: the Council agreed its negotiating position on 21 October 2026, and talks with the European Parliament can only start once Parliament has adopted its own position. The separate Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744, does not concern the CRA.
What should manufacturers check now?
- Map each product with digital elements and its category under Implementing Regulation (EU) 2025/2392.
- Register on the Single Reporting Platform, with a backup user, and identify the coordinating CSIRT.
- Run a 24-hour intake for vulnerability reports and exploitation signals, linked to your incident process.
- Keep a software bill of materials up to date: see our SBOM and CycloneDX practical guide.
- Put reporting and update duties into supplier contracts: see CRA contract clauses for digital product suppliers.
- Book notified-body capacity early if your products are important or critical.
The frameworks ResiPlan maps, including the CRA, are listed at https://www.resiplan.eu/en/compliance-frameworks.
Frequently asked questions
Do the reporting obligations cover products sold before 2027?
Yes. Article 69(3) applies Article 14 to all in-scope products already on the market, including those placed on the market before 11 December 2027.
Do importers and distributors have to report?
Article 14 targets manufacturers. An importer or distributor that sells a product under its own name or trademark, or substantially modifies it, is treated as a manufacturer and must report (Article 21). Their own obligations under Articles 19 and 20 apply from 11 December 2027.
Are open-source projects concerned?
Open-source software stewards must report under Article 24(3) to the extent they are involved in development; the Commission indicates these duties apply from 11 December 2027. Administrative fines do not apply to stewards (Article 64(10)).
Is the final report due 14 days after the incident?
Not always. The 14-day final report applies to actively exploited vulnerabilities, counted from when a fix or mitigation is available. For severe incidents, the final report is due within one month after the 72-hour notification.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex
- Implementing Regulation (EU) 2025/2392, EUR-Lex
- Delegated Regulation (EU) 2026/881, EUR-Lex
- European Commission, CRA reporting obligations
- European Commission, CRA implementation calendar
- European Commission, guidance of 27 July 2026
- European Commission, CRA standardisation
- Standardisation request C(2025) 618, Commission register
- ENISA, CRA Single Reporting Platform
- Digital Omnibus proposal COM(2025) 837, EUR-Lex
- Council of the EU, press release of 21 October 2026