If a customer tells you on a Friday evening that attackers are using a flaw in your product, the clock may already be running. Under the EU Cyber Resilience Act (CRA), a manufacturer must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability. That duty has applied since 11 September 2026; most other CRA obligations start on 11 December 2027.
This article is for product and technology leads at companies selling software, or hardware with software, in the EU. It is not legal advice; check your position with counsel.
Is the duty yours?
The product test. The CRA covers a "product with digital elements": a software or hardware product, including its remote data processing solutions, that connects directly or indirectly to a device or network (Regulation (EU) 2024/2847, Articles 2(1) and 3(1)). Installed applications, firmware, device apps and cloud functions the product cannot work without are the typical cases. Recital 12 adds that the NIS2 Directive, not the CRA, applies to cloud computing services such as software as a service, unless the service is a remote data processing solution of a software or hardware product.
The market test. A manufacturer is whoever develops or has developed a product and markets it under its own name or trademark, paid or free (Article 3(13)). The Regulation applies to products supplied for distribution or use on the Union market in the course of a commercial activity (Article 3(22) and recital 15). Software you write only for your own staff is not supplied that way; if you also sell or monetise it, ask counsel.
Reporting also reaches products shipped before December 2027: Article 69(3) applies Article 14 to all in-scope products already on the market, and the Commission guidance says the duty continues after support ends. Exploitation you already knew about before 11 September 2026 need not be reported; exploitation you learn about after that date must be, even if the flaw is old.
What starts the clock
The CRA defines an "actively exploited vulnerability" as one for which there is reliable evidence that a malicious actor has exploited it in a system without the system owner's permission (Article 3(42)). The Commission's guidance on "becoming aware" (paragraphs 211 to 214 of the annex to the Commission guidance of 27 July 2026) says that when a suspicious event or an outside tip arrives, you should assess it immediately. You count as aware once that initial assessment gives you a reasonable degree of certainty that a vulnerability in your product is being actively exploited.
That is why a named decider matters: without one, days pass before anyone says "yes, this is exploited".
The Commission FAQ names cases that do not trigger the duty. A flaw reported by a good-faith researcher or through a bug bounty, with no evidence of malicious use, is not an actively exploited vulnerability. A flaw in a third-party component that has not been exploited in your product is not reportable by you; one that has been exploited in your product is, even though the component is not yours. The FAQ says it is not an authoritative position of the Commission.
The reports and their deadlines
Article 14(2) sets three reports for an actively exploited vulnerability. Later reports are needed only "unless the relevant information has already been provided".
| Report | Deadline | What it carries |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | That a vulnerability is being exploited, and the Member States where you know the product is available |
| Vulnerability notification | Within 72 hours of becoming aware | Product information, the general nature of the exploit and flaw, measures taken, measures users can take, how sensitive you consider the information |
| Final report | No later than 14 days after a corrective or mitigating measure is available | Description with severity and impact, information on the attacker where available, details of the fix |
A severe incident affecting your product's security follows the same 24-hour and 72-hour steps, with the final report due one month after the 72-hour notification (Article 14(4)); Article 14(5) defines "severe".
You must also tell affected users, and where appropriate all users, what happened and what they can do (Article 14(8)); the Commission guidance says this need not be public.
For breaches of Article 14, fines can reach EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Article 64).
Where and how you file
All notifications go through the Single Reporting Platform (SRP) that ENISA, the EU cybersecurity agency, operates (ENISA SRP page). You file once, to the national CSIRT of the Member State where your cybersecurity decisions are mostly taken (Article 14(7)); ENISA sees it at the same time.
ENISA's FAQ describes the practical limits:
- Personal accounts. Users are called assigned representatives (ARs) and sign in with their own EU Login account with multi-factor authentication, so a shared login does not work.
- Primary and secondary representatives. One primary AR per manufacturer can invite up to 20 secondary ARs. Either kind can file and update notifications.
- Verification runs alongside filing. The CSIRT verifies the AR's link to the manufacturer in parallel, and an unverified AR may submit up to 20 notifications first. ENISA asks manufacturers to register when they first need to file; registration takes a few minutes if an EU Login account exists.
- No API. Notifications are typed into the web interface.
- Platform outage. If the SRP is down, wait for it; you may contact your CSIRT directly if immediate communication is necessary, but must still file in the SRP afterwards.
- Counter quirk. The platform currently shows the 72-hour due time as 48 hours after the early warning; the legal deadline runs from awareness.
ENISA upgraded the platform on 4 November 2026 and is updating its guidance, so check page dates.
Three roles to name before the first case
You need three named people, not a large process. A leaked key first-hour guide uses the same idea of roles agreed before the incident.
- The decider judges whether the evidence reaches reasonable certainty and records the time and evidence. Choose someone senior enough to decide without a meeting.
- The filer and a backup filer hold personal EU Login accounts and are registered as ARs.
- The user informer drafts the customer notice under Article 14(8) and has the customer contact list.
The first week
- Name the roles. One line: decider, backup, and how to reach them out of hours.
- Create the accounts. Both filers set up EU Login with multi-factor authentication, which can be done in advance.
- Find your CSIRT. Work out your main establishment and check ENISA's list of CSIRTs designated as coordinators.
- Open a case record. One page: source, evidence, product and version, time you became aware, decider, what is filed.
- List what you ship. Write down products, versions still in customers' hands and third-party components inside them. A bill of materials for AI components shows what to ask suppliers.
- Connect it to patching. The 14-day final report waits for a fix or mitigation. A monthly patch routine with one owner and a rollback plan is the model for who ships it.
- Run a drill. Take a made-up case, let the decider rule, and have the filer open the early-warning form without submitting it.
When this does not fit
If you only run software as a service with no installed component, the CRA probably does not apply to you, though NIS2 might. Hybrid products are the grey area: a cloud function counts only if the product cannot do one of its functions without it. The Commission's FAQ and guidance are not binding interpretations. Whether an event is reliable evidence of exploitation needs a person with the facts.
The next step
The deadline is not the hard part; deciding quickly is. Name the decider and two filers this week, and run the drill within a month. If you want help designing vulnerability intake, patch flow and records around your own product, get in touch with White Veil Industries.
Sources
- European Parliament and Council, Regulation (EU) 2024/2847 (Cyber Resilience Act) (2024): EUR-Lex. Articles 2, 3, 14, 64, 69 and 71 and recitals 12 and 15, read on 13 November 2026.
- European Commission, Cyber Resilience Act - Reporting obligations (11 September 2026): digital-strategy.ec.europa.eu.
- European Commission, Commission guidance on the application of the Cyber Resilience Act, C(2026) 5252, annex, section 9.1 (27 July 2026): announcement page.
- European Commission services, FAQs on the Cyber Resilience Act, section 5, version 1.1 (17 December 2025): library page.
- ENISA, Single Reporting Platform (SRP) (page current on 13 November 2026): enisa.europa.eu, and ENISA, CRA SRP Frequently Asked Questions (updated 15 October 2026): FAQ. Platform statements are ENISA's own description of its service.
