The EU Cyber Resilience Act’s Reporting Started last Friday, September 11. Here’s a Very, Very Brief Primer

If you weren’t quite sure about the EU Cyber Resilience Act, this is what it does:

The Cyber Resilience Act (CRA) Regulation establishes mandatory cybersecurity requirements for “products with digital elements” (PDEs) that are placed on the EU market, in the course of commercial activity, whether in return for payment or free of charge. The stated objectives are: 1) ensuring that manufacturers improve the security of PDEs; 2) a coherent cybersecurity framework for hardware and software producers; 3) enhancing transparency; and 4) enabling businesses and consumers to use products with digital elements securely.

What are PDEs?

PDEs are software or hardware products and their remote data processing solutions, including software or hardware components being placed on the market separately. Remote data processing  is processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the PDE from performing one of its functions.

The scope is intended to cover products that have the ability to exchange digital information (not just respond or activate in response to a signal) and therefore may put it at risk. Further, software downloaded and installed or supplied to the user and that executes on the user’s system (e.g., a browser extension or mobile app downloaded from an app store) is in scope. Hardware and software provided by the same manufacturer in order for a product to function (e.g., drivers or interface apps), are together a PDE, even if supplied separately. But software that executes remotely and is only accessed by the user, is not necessarily a PDE (e.g., websites, unless they support the functionality of a PDE through remote processing).

From last Friday,  manufacturers of PDEs must report actively exploited vulnerabilities and severe security incidents using ENISA’s Single Reporting Platform. This is effectively first CRA deadline for manufacturers. The essential cybersecurity requirements — the ones most compliance programs are built around — don’t arrive until December 11, 2027, so we will not bore you with those here.

What must be reported after Friday, September 11, 2026?

A manufacturer must submit via the single reporting platform, a number of reports on actively exploited vulnerabilities and severe incidents having an impact on the security of the PDE, including, as applicable:

1. An early warning notification, without undue delay and in any event within 24 hours of becoming aware.
2. A vulnerability/incident notification, without undue delay and in any event within 72 hours of becoming aware, which should provide information about the product/nature of the incident, nature of the exploit and vulnerability/initial assessment of the incident; corrective or mitigating measures taken and which users can take; and an indication of the sensitivity.
3. For a vulnerability, a final report no later than 14 days after a corrective or mitigating measure is available, including the vulnerability, its severity and impact; information concerning any malicious actor, details about any security update or corrective measures. For a severe incident, within one month after the 72 hour incident notification, with description of the incident, severity and impact, the type of threat or root cause; and applied and ongoing mitigation measures.

If this looks familiar, it is a similar reporting timeline to the significant incident reporting under the EU’s NIS-2 Directive already in effect under national implementing law for covered essential or important entities operating in enumerated critical sectors. However, the CRA obligations apply much more broadly to PDEs and are not limited by size of enterprise or sector.

What’s Next?

Manufacturers should have process in place to handle the new reporting obligations and those with NIS-2 obligations, should be able to integrate at least some of the incident response workflow for these two distinct obligations. That said, a reliance on current business processes to report security issues will unlikely be sufficient. Still, if you find yourself owning or playing a part in the rest of the CRA compliance program, however, the broader requirements do not kick in until December 11, 2027 — which means there is still time to work through the Commission’s 80-plus pages of currently issued guidance intended to simplify CRA implementation for market operators, and any further guidance yet to be published.