A duty that has sat on the statute book since 2024 starts to bite today. From 11 September 2026, manufacturers of products with digital elements must notify actively exploited vulnerabilities and severe incidents affecting the security of those products. The duty sits in Article 14 of Regulation (EU) 2024/2847, the Cyber Resilience Act. A product with digital elements, in the Regulation’s own terms, is a software or hardware product together with its remote data processing solutions. The Regulation entered into force on 10 December 2024 and becomes fully applicable on 11 December 2027. Reporting arrives early, as did Chapter IV on the notification of conformity assessment bodies, which applied from 11 June 2026.
The clock
The deadlines are short and they run from awareness, not from confirmation. A manufacturer must send an early warning within 24 hours of becoming aware, and a fuller notification within 72 hours. For an actively exploited vulnerability, a final report follows no later than 14 days after a corrective measure is available. For a severe incident, the final report is due within one month of the 72-hour submission.
Reporting happens once. It goes through the CRA Single Reporting Platform, the online tool that ENISA, the EU Agency for Cybersecurity, develops and operates under Article 16. The Commission states that the platform will be operational by 11 September 2026. The notification is addressed to the computer security incident response team, or CSIRT, of the Member State where the manufacturer has its main establishment. ENISA receives the information at the same time, unless particularly exceptional circumstances apply. The receiving CSIRT then passes it without delay to the CSIRTs of other Member States where the product has been made available. On 11 December 2025 the Commission adopted a delegated act, a measure filling in detail under powers given by the Regulation, setting the terms for delaying that onward sharing on cybersecurity grounds.
Who carries the duty
This is where advisers should read the instrument rather than the coverage. Legal IT Insider reported on 10 September 2026 that manufacturers, distributors and importers must submit the 24-hour warning. The Commission’s material and ENISA’s own platform page both place that notification on the manufacturer, and on open-source software stewards under Article 24. The accounts differ. Under the Commission’s summary, importers and distributors have a narrower duty: on becoming aware of a vulnerability they inform the manufacturer. Any person may also report on a voluntary basis through the platform.
Why it changes the advice
Scope makes this live for products nobody is currently building. Reporting obligations cover all products with digital elements made available on the Union market, including those already placed on the market before 11 December 2027. A product placed on the market years ago can trigger a notification next week.
Penalties are set at national level under Chapter VII, so the exposure depends on the Member State. Two softenings matter. Manufacturers that qualify as microenterprises or small enterprises may not be fined for missing the 24-hour deadline. Open-source software stewards are not subject to penalties for infringements at all.
The practical consequence is that a 24-hour duty is a process problem before it is a legal one. Contract drafting will not save a client who learns of an exploited vulnerability on a Friday evening and has nobody authorised to file. Counsel advising a vendor needs two things settled in advance: which products fall inside the Regulation, and whether the incident response process can escalate to a filing decision within a day. The Commission published practical guidance on 27 July 2026 to help manufacturers meet these obligations. For students, the structure is a useful example of how EU product law now works: a single obligation, a single platform, and enforcement left to national regimes.
Sources
- European Commission, Cyber Resilience Act – Reporting obligations, 31 July 2026.
- European Commission, The Cyber Resilience Act – Summary of the legislative text, 3 December 2025.
- European Commission, Cyber Resilience Act, 7 September 2026.
- ENISA, Single Reporting Platform (SRP).
- Legal IT Insider, Cyber Resilience Act reporting rules kick in – Are you CRA compliant?, 10 September 2026.