Cyber Resilience Act reporting: the 24-hour rule explained

Cyber Resilience Act reporting is the legal duty on manufacturers of products with digital elements to report actively exploited vulnerabilities and severe security incidents to the authorities, starting with an early warning within 24 hours of becoming aware. The duty has applied since 11 September 2026, more than a year before the rest of the Act, and it covers products already on the EU market. Reports go through ENISA's Single Reporting Platform, and a full notification and final report follow the early warning.

Key takeaways

• CRA reporting has applied since 11 September 2026, while most other CRA obligations start on 11 December 2027.
• It covers actively exploited vulnerabilities and severe incidents, not every bug you find.
• The clock is 24 hours for an early warning, 72 hours for a notification, then 14 days or one month for a final report.
• All reports go through ENISA's Single Reporting Platform, which routes them to the national CSIRT and ENISA at once.
• Products placed on the market before December 2027 are still covered by the reporting duty.

What does the Cyber Resilience Act reporting rule require?

It requires a manufacturer to notify two kinds of events: actively exploited vulnerabilities in its product, and severe incidents affecting the security of that product. Article 14 of Regulation (EU) 2024/2847 says notifications go "simultaneously to the CSIRT designated as coordinator" and to ENISA, through a single reporting platform.

Two definitions matter:

• An actively exploited vulnerability is "a vulnerability for which there is reliable evidence that a malicious actor has exploited it" (Article 3(42)). A flaw found in your own code review, or reported by a researcher with no sign of real-world abuse, is not yet in this category.
• A severe incident is one that affects the security of the product. Under Article 14(5), one of the tests is whether the incident "has led or is capable of leading to the introduction or execution of malicious code" in a product. A compromised build server or update channel is the classic example.

Reporting other vulnerabilities is voluntary. Article 15 lets anyone notify vulnerabilities to a CSIRT or ENISA on a voluntary basis.

What are the exact deadlines?

There are three stages, and the first is the one that catches teams out. The table sets out the timelines in Article 14.

Stage	Actively exploited vulnerability	Severe incident
Early warning	Within 24 hours of becoming aware	Within 24 hours of becoming aware
Notification	Within 72 hours of becoming aware	Within 72 hours of becoming aware
Final report	No later than 14 days after a corrective or mitigating measure is available	Within one month after the incident notification

Ireland's National Cyber Security Centre puts it plainly on its CRA reporting page: for the early warning, "Do not delay submission pending a deep technical analysis." The early warning is meant to be short. Detail comes in the 72-hour notification and the final report.

The clock starts when you become aware, not when you finish investigating. The Commission's guidance, as summarised by Orrick, says "becoming aware" should be read consistently with existing NIS2 implementing rules and the GDPR breach guidelines. Teams that have run a GDPR data breach notification process will recognise the logic.

How do you actually submit a report?

You submit it through ENISA's Single Reporting Platform (SRP). ENISA launched the platform's initial operating capability on 11 September 2026. You report once: the CSIRT designated as coordinator receives the notification and passes it to CSIRTs in other Member States where the product is available, while ENISA receives it at the same time.

Which CSIRT is "yours" depends on where you have your main establishment in the EU, under Article 14(7). The Act sets a fallback order for manufacturers with no EU establishment.

For Irish manufacturers, the NCSC adds three practical points:

1. Only notifications submitted through the SRP satisfy the statutory obligation.
2. No pre-registration is needed; the account is created on first submission.
3. If ENISA officially declares the SRP offline, email to cra_fallback@ncsc.gov.ie is accepted, but the report must be resubmitted through the SRP once it is back.

Who has to report, and which products are covered?

The duty falls on manufacturers of products with digital elements made available on the EU market. The Act defines these as "a software or hardware product and its remote data processing solutions" (Article 3(1)). That includes connected devices, firmware, desktop and mobile software, and the cloud back end a device needs to work. Medical devices, motor vehicles and certified aviation products are excluded under Article 2.

The key point for anyone with products already on sale: the reporting duty is not limited to new products. Article 69 says Article 14 obligations apply to all in-scope products placed on the market before 11 December 2027. A smart device you shipped in 2023 is covered today if it is still on the market and in use.

If you are unsure whether your software or SaaS product is in scope at all, read our guide on whether the Cyber Resilience Act applies to software and SaaS.

Do you also have to tell your customers?

Yes. Article 14(8) requires manufacturers to inform affected users after becoming aware of an actively exploited vulnerability or a severe incident and, where necessary, explain what they can do to mitigate it. Plan the customer notice alongside the regulatory one, because the same facts feed both.

What happens if you miss the 24-hour deadline?

Breaches of Article 14 fall in the highest penalty band of the CRA: up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, under Article 64. There is a specific concession for smaller firms. Article 64(10) says those fines do not apply to manufacturers that qualify as microenterprises or small enterprises for missing the 24-hour early-warning deadlines in Articles 14(2)(a) and 14(4)(a).

That concession is narrow. It covers only the early-warning deadline, not the 72-hour notification, the final report or the duty to inform users. Small companies should still build the process.

How should a small manufacturer prepare?

Treat reporting as a process you rehearse, not a form you find on the day. A workable setup for a small product company:

1. Know what you ship. Keep a current list of products, versions and components, ideally a software bill of materials, so you can tell quickly whether a public exploit affects you.
2. Open an intake channel. Publish a security contact and a vulnerability disclosure policy so reports reach the right person.
3. Name an owner and a deputy. Someone must be able to file an early warning on a Saturday.
4. Write a one-page triage rule. Define what "reliable evidence of exploitation" means for your product and who decides.
5. Pre-fill what you can. Product names, versions, contact details and your Member State of main establishment do not change between incidents.
6. Run a tabletop exercise. Walk through one exploited-vulnerability scenario and one compromised-update scenario against the clock.

The Commission's guidance of 27 July 2026 explains how to meet the reporting obligations and includes 67 practical examples, with attention to microenterprises and SMEs. It is non-binding but worth reading before your first drill.

Frequently asked questions

Does the Cyber Resilience Act reporting rule apply before December 2027?

Yes. Article 14 has applied since 11 September 2026, under Article 71 of the CRA. The product security requirements in Annex I apply from 11 December 2027, but reporting started earlier.

Do I have to report every vulnerability in my product?

No. Mandatory reporting covers actively exploited vulnerabilities, meaning there is reliable evidence a malicious actor has exploited them, and severe incidents. Other vulnerabilities can be reported voluntarily under Article 15, and must still be fixed under your vulnerability handling process.

Where do I send a CRA report from Ireland?

Through ENISA's Single Reporting Platform. The NCSC says only SRP submissions satisfy the legal obligation, with an email fallback to the NCSC only when ENISA declares the platform offline.

What should a 24-hour early warning contain?

Enough to alert the authorities: the product concerned, that exploitation or a severe incident has occurred, and the Member States where the product is available as far as you know. Fuller technical detail follows in the 72-hour notification and the final report.

Are small companies exempt from CRA reporting?

No. Microenterprises and small enterprises cannot be fined for missing the 24-hour early-warning deadline, but the reporting duty itself, the 72-hour notification, the final report and the duty to inform users all still apply.

Building a connected product and want a second opinion on its security plan? Book a free 30-minute call with our team.

Cover photo by Rodolfo Gaion on Pexels.