To harmonize cybersecurity requirements across the EU, the Cyber Resilience Act (CRA) applies to hardware and software products made available in the EU whose intended or reasonably foreseeable use involves a direct or indirect connection to a device or network. This includes software applications, Internet-of-Things (IoT) products, routers, connected machinery and separately marketed digital components (e.g., smartphones, laptops, smart home products, smartwatches, connected toys, microprocessors, firewalls, connected machinery, accounting and finance software, games and apps, as well as open-source software supplied in the course of a commercial activity).
While most CRA obligations will apply from 11 December 2027, manufacturers must comply with reporting obligations under CRA Article 14 from 11 September 2026. This also applies to products with digital elements that have already been placed on the EU market. These reporting obligations concern
- Actively exploited vulnerabilities, i.e., security weaknesses for which there is reliable evidence that a malicious actor has exploited them. For example, the confirmed exploitation of an authentication flaw to obtain unauthorized access.
- Severe incidents affecting the security of a product, for example, an incident that comprises the confidentiality or integrity of sensitive data.
The reporting process under the CRA is staged as follows:
- An early warning must be submitted without undue delay and, in any event, within 24 hours of the manufacturer becoming aware of the vulnerability or incident. The notification must be submitted through the CRA single reporting platform (SRP), operated by the EU Agency for Cybersecurity (ENISA), and is made available to the relevant computer security incident response team (CSIRT) designated as coordinator and, generally, simultaneously to ENISA. The competent CSIRT is determined in accordance with the CRA and selected by the manufacturer when submitting the notification. It is generally the CSIRT of the member state in which the manufacturer has its main establishment, i.e., where decisions concerning the cybersecurity of its products are predominantly taken.
- The individual submitting the notification on behalf of the manufacturer must have an EU login account (EU LOGIN) and register as an “Assigned Representative” of the relevant manufacturer. Advance registration with the SRP is not required. Registration and association with the relevant manufacturer can be competed in connection with the first notification. Prior validation of the association by the CSIRT is not a prerequisite for submission. However, an EU login account should be set up in advance.
- Within 72 hours, the manufacturer must submit a more detailed notification. Depending on the event, this must include available information on the affected product, the nature, severity and impact of the vulnerability or incident, as well as any corrective or mitigating measures taken or available.
- A final report must subsequently be submitted: for an actively exploited vulnerability, generally no later than 14 days after a corrective or mitigating measure becomes available; for a severe incident, within one month after the 72 hour notification.
In addition, after becoming aware of an actively exploited vulnerability or severe incident, manufacturers must inform impacted users without undue delay and, where appropriate, all users. The information must include any measures users can take to mitigate or correct the risk where necessary.
Although the CRA’s general product compliance requirements do not yet apply to the relevant product, manufactures nevertheless become subject to these reporting obligations from 11 September 2026.
In-scope businesses should therefore assess
- Which hardware and software products fall within the CRA’s scope
- Which entity qualifies as the manufacturer and which CSIRT will be competent
- Whether identified vulnerabilities are merely theoretical or are actively exploited, and whether incidents meet the CRA’s severity criteria based on their impact on sensitive or important data or functions or the execution of malicious code
- Whether robust internal 24 and 72 hour identification, escalation and reporting processes are in place
For further practical guidance, the German Federal Office for Information Security (BSI) has published the Technical Guideline BSI TR 03183-1, “Cyber Resilience Requirements for Manufacturers and Products Part 1: General requirements” (BSI TR), which provides nonbinding, introductory guidance on the implementation of the CRA, and is aimed particularly at manufacturers that have not yet established mature IT security processes for product development and vulnerability handling.
Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.
Recent Comments