Since 11 September 2026, Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") applies (Art. 71(2)). If you sell an app, a plugin, an SDK or a device with firmware in the EU, you now have to report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours. This applies to products you already sell, not only to new ones (Art. 69(3)). The rest of the CRA follows on 11 December 2027.
This guide explains who is covered, what you have to report, the deadlines, where you report and what to prepare now - before the first report is due.
Who is covered
The duty applies to the manufacturer: a person or company that develops or manufactures products with digital elements, or has them developed, and markets them under its own name or trademark, "whether for payment, monetisation or free of charge" (Art. 3(13)).
A product with digital elements is "a software or hardware product and its remote data processing solutions", including components placed on the market separately (Art. 3(1)). In practice this includes:
- desktop and mobile apps that customers install;
- WordPress plugins, browser extensions and other code that customers run in their own systems;
- SDKs and libraries that other companies build into their products;
- devices with firmware.
Your backend counts too, if the product cannot perform one of its functions without it (Art. 3(2)).
Pure SaaS is outside. Recital 12 says that websites which do not support the functionality of a product with digital elements, and cloud services designed outside the responsibility of a product's manufacturer, are not covered. A web app used only in the browser, with nothing to install, is not a product with digital elements.
There is no size exemption from the reporting duty. A two-person company selling a plugin has the same duty to report as a large vendor. The only relief for small companies concerns fines (see below).
What you have to report
An actively exploited vulnerability is "a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner" (Art. 3(42)). A vulnerability is a weakness that can be exploited by a cyber threat (Art. 3(40)).
So a new CVE on its own is not reportable. It becomes reportable when there is reliable evidence that someone is actually exploiting it. The duty covers vulnerabilities "contained in the product" (Art. 14(1)), so a flaw in a library you ship with your product can trigger it.
A severe incident is an incident that affects, or can affect, your product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or that has led or can lead to the introduction or execution of malicious code (Art. 14(5)). A compromised build server or update channel is a typical example.
The deadlines: 24 hours, 72 hours, 14 days
The clock starts when you become aware of the actively exploited vulnerability (Art. 14(2)).
| Step | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | within 24 hours, with the Member States where you know the product is available (Art. 14(2)(a)) | within 24 hours, also saying if you suspect unlawful or malicious acts (Art. 14(4)(a)) |
| Notification | within 72 hours: general information about the product, the nature of the exploit and the vulnerability, measures you took and measures users can take (Art. 14(2)(b)) | within 72 hours (Art. 14(4)(b)) |
| Final report | no later than 14 days after a fix or mitigation is available: description, severity and impact, information on the malicious actor if available, details of the security update (Art. 14(2)(c)) | within one month after the 72-hour notification (Art. 14(4)(c)) |
You must also inform your users about the vulnerability or incident and, where needed, the measures they can take, where necessary in a structured, machine-readable format (Art. 14(8)).
What micro and small companies get. Manufacturers that qualify as micro or small enterprises cannot be fined for missing the 24-hour early-warning deadline (Art. 64(10)(a), referring to Art. 14(2)(a) and 14(4)(a)). The duty to report stays. The 72-hour notification and the final report are not covered by this exception.
Where you report
You report once, via the Single Reporting Platform run by ENISA (Art. 14(1), Art. 16). The platform has been live since 11 September 2026 at portal.cra-srp.enisa.europa.eu.
Your notification goes at the same time to ENISA and to the CSIRT designated as coordinator in the Member State of your main establishment (Art. 14(1) and 14(7)). That CSIRT shares it with the CSIRTs of other Member States where your product is available (Art. 14(7)). You do not file 27 separate reports.
To submit, you need users registered on the platform as Assigned Representatives acting for your company (ENISA). Do it now, not at hour 20 of an incident. ENISA publishes an FAQ, user manuals and tutorial videos for the platform.
What to prepare now
Most companies will not need to report this year. But when they do, 24 hours is short. These are the things that save the most time:
- A list of what is inside your product. You cannot say within hours whether an exploited CVE affects you if you do not know your dependencies. From 11 December 2027 this becomes a formal requirement: a software bill of materials (SBOM) in a common machine-readable format, covering at least the top-level dependencies (Annex I, Part II, point 1). Generate it with every release.
- A contact address for vulnerability reports (Annex I, Part II, point 6). A common way is a security.txt file at
/.well-known/security.txt. It has two required fields:ContactandExpires(RFC 9116). - A coordinated vulnerability disclosure policy (Annex I, Part II, point 5): how people report to you, how fast you reply, when you publish.
- Your Single Reporting Platform registration, with at least two people who can submit.
- Draft templates for the 24-hour early warning and the 72-hour notification, with the fields from Art. 14(2) already filled in for your product.
- A channel to reach your users - mailing list, in-app message or update notes - for the information required by Art. 14(8).
What changes on 11 December 2027
From that date the whole CRA applies (Art. 71(2)) to products you place on the market from then on. Products already on the market are covered only after a substantial modification - but reporting applies to all of them already (Art. 69(2) and 69(3)).
The main new duties: essential cybersecurity requirements in Annex I, the SBOM and disclosure policy above, a support period of at least five years (unless the product is expected to be used for less) with free security updates (Art. 13(8)), technical documentation, an EU declaration of conformity and the CE marking (Art. 13(12)). Micro and small companies may provide the technical documentation in a simplified format (Art. 33(5)). Fines for breaching Annex I or Articles 13 and 14 go up to 15 million EUR or 2.5% of worldwide annual turnover (Art. 64(2)).
Not sure where you stand?
Take the free "Does the CRA apply to me and what must I do by December 2027" check: 8 questions, about 3 minutes. You get your result on screen and a checklist by e-mail. Take the free check
If the CRA applies to you, Earlybell does this work every week: SBOM with every release, a daily check of your dependencies, ready-to-send drafts of the 24-hour and 72-hour reports for you to submit, and an up-to-date disclosure policy and security.txt. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act) and on information published by ENISA and the European Commission. It is not legal advice. Article numbers refer to that Regulation.