EU Cyber Resilience Act (CRA): The 24-Hour Reporting Rule

For years, cybersecurity reporting in the software and hardware industry was largely voluntary. That changes on September 11, 2026.

While the full breadth of the EU Cyber Resilience Act (CRA) and its "CE" marking requirements won't apply until late 2027, the mandatory vulnerability and incident reporting obligations arrive much sooner.From this date forward, any "product with digital elements" (PDE) made available on the EU market must comply with a strict, tiered reporting clock.

The September 11 Milestone

The 2026 deadline is a "derogation" in the law—a specific carve-out designed to force organizations to build their incident response capabilities early.

• Scope: This applies to almost all connected products, including software, IoT devices, networking gear, and even legacy products that remain on the market after this date.

• The "Awareness" Trigger: The reporting clock begins the moment a manufacturer becomes aware of an actively exploited vulnerability or a severe security incident.

The Reporting Tiers: 24h / 72h / 14d

The CRA introduces a staged notification process.You are not required to have all the answers in the first hour, but you are required to show the regulator that you are moving.

1. Early Warning (Within 24 Hours)

The first notification is sent to the Single Reporting Platform (SRP) managed by ENISA and your national CSIRT (Computer Security Incident Response Team).

• Requirement: State that an actively exploited vulnerability exists.

• Content: Identify the affected product, versions, and whether the incident is suspected to be caused by a malicious actor.

2. Vulnerability Notification (Within 72 Hours)

This is a more detailed update on the situation.

• Content: Provide an initial assessment of the vulnerability's nature, the exploit's general characteristics, and any initial mitigation measures taken or recommended for users.

3. Final Report (Within 14 Days)

This is the "Closing Report" submitted once a corrective measure (like a patch) is available.

• Content: Provide a comprehensive technical description, including severity, impact analysis, information about the malicious actors (if known), and the permanent security update details.

The Role of the SBOM: You Can't Report What You Don't Know

The 24-hour rule makes manual investigation impossible.To comply, organizations must have a Software Bill of Materials (SBOM) that is integrated into an automated monitoring system.

• Identification: If a new vulnerability (CVE) is announced in an open-source library, your system must immediately flag every product version that uses that library.

• Exploitability Assessment: You must quickly determine if the vulnerability is actively exploitable in your specific product configuration.

• Traceability: The CRA requires SBOMs to be machine-readable (e.g., CycloneDX or SPDX)so they can be ingested by the EU's reporting tools during an audit or incident investigation.

2026 Preparation Checklist

• [ ] Inventory Your Legacy Products: Identify which "digital products" will still be on the market in September 2026. These are your first compliance targets.

• [ ] Automate Vulnerability Feeds: Connect your SBOMs to live feeds like the CISA KEV (Known Exploited Vulnerabilities) or the EU Vulnerability Database (EUVD).

• [ ] Conduct a "Dry Run": Run a tabletop exercise where a vulnerability is "discovered" on a Friday afternoon. Can your team draft and submit an ENISA notification within 24 hours?

• [ ] Verify Micro-Enterprise Status: Note that micro and small enterprises have some relief regarding the penalties of the 24-hour deadline, but they are still required to report.

← Back to resources