• The EU Cyber Resilience Act’s reporting duties apply from September 11, and they reach back to products shipped years ago.
• ENISA’s reporting platform opened the same day, with no API and no voluntary reporting at launch.

The EU Cyber Resilience Act’s (CRA) vulnerability and incident reporting obligations took effect on September 11, 2026, fifteen months before the regulation’s main cybersecurity requirements apply on December 11, 2027. Manufacturers of products with digital elements sold in the European Union (EU) must now report actively exploited vulnerabilities and severe incidents affecting product security, according to the European Commission, which sets an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available.

The EU Agency for Cybersecurity (ENISA) launched the CRA Single Reporting Platform on the same date, and it is the only channel through which those notifications may be filed. The agency has described the launch as a first stage, with functionality to be expanded over the coming months based on operational experience.

EU Cyber Resilience Act reporting reaches products already on the market

Article 69(3) extends the reporting duty to every in-scope product placed on the EU market before December 2027. Reporting is the only part of the regulation that reaches legacy products by default, since the remaining requirements apply to them only where a product undergoes a substantial modification under Article 69(2). A router shipped in 2022 or firmware distributed before the regulation entered into force sits inside the obligation from September 11.

That matters because the reporting decision depends on component-level knowledge. Commission guidance requires a manufacturer to report an actively exploited vulnerability originating in a third-party component contained in its product, but exempts cases where the vulnerable code cannot be exploited in that product, for example because it is not reachable, or has not been exploited in it. Making that call within 24 hours requires a software bill of materials for a product generation that may predate the vendor’s current build pipeline.

The same guidance rules out retrospective filings. A manufacturer does not need to report exploitation it was already aware of before September 11. Where it knew of a vulnerability before that date without knowing of active exploitation, and exploitation surfaces afterwards, the vulnerability becomes reportable.

The EU Cyber Resilience Act clock starts before confirmation

ENISA’s platform has no API at initial release, so mandatory reports are submitted through the web portal rather than an automated pipeline. Voluntary reporting is also unavailable at launch, with ENISA saying that function arrives in a later phase. Manufacturers can automate their internal reporting workflow, but the final submission is manual.

The 24-hour period begins when a manufacturer becomes aware of a vulnerability, not when it confirms one, so a vendor that completes internal verification before notifying may already be late. That judgement rests on work the regulation assumes is done: Article 13(2) requires manufacturers to have carried out a product-level cybersecurity risk assessment, which is what gives them a baseline for deciding whether an exploit is active or an incident severe.

Non-compliance carries administrative fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.

Where EU Cyber Resilience Act reports actually go

A notification goes to the national Computer Security Incident Response Team (CSIRT) designated as coordinator for the member state where the manufacturer has its main establishment, and is made available to ENISA at the same time unless exceptional circumstances apply, per the Commission. The receiving CSIRT then shares it without delay with its counterparts in other member states where the product is available. Those teams pass information to national market surveillance authorities, which hold the enforcement powers.

Manufacturers also have to coordinate CRA filings with parallel duties under NIS2 and the GDPR, a point raised by Freshfields, which notes that the reporting channels remain separate while the Digital Omnibus consolidation is still pending. 

ENISA has not published figures on how many notifications the platform has received since it opened, or a date for API availability. Manufacturers face a further deadline on December 11, 2027, when the CRA’s main cybersecurity requirements apply and open-source software stewards come into scope for reporting.