As of Today, 11 September 2026, the reporting obligations under the Cyber Resilience Act (CRA) officially enter into application across the European Union.
Under Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act), manufacturers of products with digital elements are now required to report:
- actively exploited vulnerabilities affecting their products; and
- severe incidents having an impact on the security of their products.
Reports must be submitted through the CRA Single Reporting Platform, established by ENISA.
An important milestone in CRA implementation
The application of the reporting obligations marks another important stage in the implementation of the Cyber Resilience Act.
The CRA introduces horizontal cybersecurity requirements for products with digital elements placed on the EU market, with the objective of ensuring that hardware and software products are designed, developed and maintained with an appropriate level of cybersecurity throughout their lifecycle.
While the CRA will become fully applicable on 11 December 2027, its implementation is taking place progressively. Provisions concerning the notification of conformity assessment bodies have already applied since 11 June 2026, while the reporting obligations apply as of today, 11 September 2026.
Manufacturers and other relevant stakeholders are encouraged to familiarise themselves with the applicable requirements and ensure that appropriate processes are in place for the timely identification, assessment and reporting of vulnerabilities and severe incidents.
For more information on the Single Reporting Platform click here.