EU Cyber ​​Resilience Act (CRA): reporting obligation begins 11 September

The Cyber Resilience Act entered into force on 10 December 2024 as Regulation (EU) 2024/2847. But entering into force and obligations starting to apply are not the same thing: the regulation sets a staged timetable and the manufacturer meets reporting first and product requirements afterwards.

The first part to apply is the reporting obligation starting on 11 September 2026. The rest of the regulation — the essential cyber security requirements, conformity assessment, the technical file and CE marking — applies in full from 11 December 2027.

The fifteen months between those two dates are not a waiting period but a preparation period. Because the reporting obligation presupposes a vulnerability management process that already works, the infrastructure that must be established in 2026 also forms the basis of the documentation required in 2027.

The scope is defined by the nature of the product rather than by product category: the phrase "product with digital elements" covers hardware and software products capable of establishing a data connection to a device or network, directly or indirectly. It need not be a consumer product; industrial equipment, components and standalone software can also fall within it.

The regulation classifies products by risk level, and as the class rises the role of a third party in conformity assessment increases. The first task is therefore to determine which class the product falls into — the class determines all subsequent decisions (self-declaration or notified body).

Assuming that a product is out of scope is risky: a device without a cloud connection but paired with a mobile app also has a digital element. In borderline cases, recording the decision in writing together with its justification is the document that proves most useful in a later inspection.

From 11 September 2026 manufacturers are obliged to report actively exploited vulnerabilities and severe incidents affecting the security of the product. The notification is made through ENISA's single reporting platform, to the relevant national CSIRT and to ENISA together.

Notification does not end with filling in a single form: it works in stages, as an early warning, then a more detailed notification and, when the process closes, a final report. This requires deciding in advance who will gather which information in the first hours of an incident.

The practical consequence is this: reporting is not a compliance clause but an operation. Unless the on-call arrangement, the communication channel, the decision maker and the record template are ready, notification cannot be made within the time limit.

The regulation provides for administrative fines for breaches of the essential cyber security requirements and the reporting clauses; the upper limit is defined as 15 million euros or 2.5% of worldwide annual turnover — whichever is higher applies.

Another consequence as important as the risk of fines is market access: a product whose conformity cannot be demonstrated cannot be placed on the EU market and the market surveillance authority can take measures including recall.

Drawing up a product inventory and determining which product has digital elements and which class it falls into is the single step that makes the whole timetable plannable. Without an inventory, every other task rests on guesswork.

The second step is announcing the support period and putting the update policy in writing. These are part of the 2027 requirements but, because they involve commercial decisions, they take the longest.

The third is establishing the vulnerability reporting channel: both an address to receive reports from outside and an internal flow to assess them. The 2026 reporting does not work without that flow.