Knowledge · 8 September 2026
Cyber Resilience Act: the reporting obligation for manufacturers already applies
Since 11 September 2026, manufacturers of products with digital elements have to report actively exploited vulnerabilities and severe incidents. For manufacturers of machinery and embedded products it is an obligation that is still hardly discussed.
If you manufacture anything that contains software — machines, devices, control units, applications — you have had a reporting obligation since 11 September 2026. It does not concern only new products: it also covers those you placed on the market years ago and that are in operation at your customers.
Far less is written about the Cyber Resilience Act than about NIS2. Yet it reaches a group of companies that have not had to deal with cybersecurity regulation so far: manufacturers.
What it is about
Regulation (EU) 2024/2847, known as the Cyber Resilience Act, introduces security requirements for products with digital elements — hardware and software that connects, directly or indirectly, to another device or to a network.
The Regulation is in force, but its obligations apply in stages (Article 71(2)):
- 11 June 2026
- Chapter IV — notification of conformity assessment bodies
- 11 September 2026
- Reporting obligations of manufacturers under Article 14
- 11 December 2027
- The whole Regulation — design requirements, conformity assessment, CE marking
Most companies noticed only the last line and planned their work around it. The reporting obligation, however, has applied since 11 September 2026.
Who it applies to
The obligation falls on the manufacturer of a product with digital elements. That is a wider group than it seems at first sight:
- manufacturers of machines and equipment with control electronics;
- manufacturers of embedded devices and IoT products;
- software suppliers, including applications and libraries;
- manufacturers of medical technology, measuring and control equipment;
- companies that place a product on the market under their own brand, even if someone else physically makes it.
These are companies that have never dealt with cybersecurity regulation — because they are often not in scope of national cybersecurity law themselves and do not see themselves as “IT companies”.
What awaits them is not what most of them know from the media. It is not a registration or a cybersecurity audit — those obligations follow from NIS2, not from this Regulation. Under this Regulation, a manufacturer has to meet the essential security requirements for the product, carry out conformity assessment and affix the CE marking, keep technical documentation including a list of components, handle vulnerabilities throughout the support period — and report actively exploited vulnerabilities and severe incidents.
What has applied since 11 September 2026
Since that date the manufacturer has to report two kinds of events.
An actively exploited vulnerability in its product. The Regulation defines it as a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner (Article 3, point 42). It is therefore not enough for the vulnerability to exist; there must be evidence that someone has actually exploited it.
A severe incident having an impact on the security of the product.
Deadlines
The deadlines run from the moment the manufacturer becomes aware of the vulnerability or incident (Article 14(2) and (4)). The early warning and the notification must, in addition, be made without undue delay.
- within 24 hours
- Early warning
- within 72 hours
- Notification
- no later than 14 days after a corrective or mitigating measure is available
- Final report — actively exploited vulnerability
- within one month after the submission of the incident notification
- Final report — severe incident
Who you report to
One submission through the single reporting platform (Article 16). The notification is addressed to the CSIRT designated as coordinator in the Member State of the manufacturer’s main establishment; ENISA is informed at the same time, so it is not a second, separate submission. The manufacturer must also inform the impacted users and, where appropriate, all users of the product.
What does not apply yet
This is just as important, because there is unnecessary panic around the CRA.
The reporting obligation did not bring in the design requirements for product security, conformity assessment, technical documentation or the CE marking under the CRA. All of that applies only from 11 December 2027.
In other words: now you have to be able to report, not to have a redesigned product. These are two entirely different levels of effort, and it is worth realising that before someone, in good faith, starts a project costing tens of thousands of euros prematurely.
The surprise most companies overlook
The reporting obligation also covers products you placed on the market before 11 December 2027 — everything you have in operation at your customers today.
In practice this means that if an actively exploited vulnerability appears in a control unit you sold between 2019 and 2023, the reporting obligation is triggered — regardless of the product having been made long before the Regulation.
For companies without an overview of which software versions are deployed where, this is the real problem — not the report itself.
What you need to have in place
The obligation already applies, so there is no time for lengthy preparation. What matters, however, is surprisingly little:
- A responsible person and a deputy. Who decides that a situation meets the definition, and who stands in at weekends and during holidays. The early warning is due within 24 hours, and that deadline does not stop on Friday at four.
- A way for the information to reach you. You will rarely learn about a vulnerability yourself — usually from a researcher, a customer or a public source. Without a published contact the information will not reach you in time, or at all.
- A contact point for reporting vulnerabilities. A
security.txtfile and a clearly stated e-mail address. An hour of work that significantly shortens the time it takes for the information to reach you. - A list of products and versions. Without it you cannot say who a vulnerability affects — or whom you have to inform.
- A report template. A structure prepared in advance, so that the first hours are not spent deciding what to write.
- A decision criterion. A simple procedure to tell “a vulnerability we fix in the next release” from “an actively exploited vulnerability we report within 24 hours”.
Where the early-warning deadline breaks in practice
On paper it looks simple: an early warning within 24 hours, a notification within 72 hours, a final report for a vulnerability no later than 14 days after a corrective or mitigating measure is available and for a severe incident within one month after the submission of the incident notification. One submission through the single reporting platform, addressed to the CSIRT in the Member State of the manufacturer’s main establishment; ENISA is informed at the same time. No separate reports for each Member State.
The deadline, however, runs from awareness, not from Monday morning.
The biggest practical challenge is an actively exploited vulnerability that appears on a Friday evening. Many companies do not have a process in place that, within a few hours, can confirm the severity of the event, involve technical experts, lawyers and management, and prepare the early warning. Deciding whether an event must be reported is not a technical decision — it has legal consequences, and someone has to make it at the weekend too.
The problem is rarely sending the notification itself. The problem is getting a reliable answer, within hours, to three questions: what the scope is, which products and versions are affected, and what the actual risk to users is. Until those answers exist, the report is either late or says something that looks different two days later — and correcting a report already submitted is a problem of its own.
In practice this means deciding four things in advance: who assesses severity outside working hours, who has immediate access to the list of products and their components, who submits the report and who communicates externally. None of this can be worked out on a Saturday.
How the CRA overlaps with NIS2
If you are already in scope of NIS2 through your national law, part of the work is done — the incident-reporting process follows a similar logic of deadlines and can be extended rather than built from scratch.
If you are not, the CRA is your first cybersecurity regulation of all. That is uncomfortable, but it also means it can be built properly from the start, with the requirements that apply from 11 December 2027 in view.
A third group are companies outside NIS2 that receive security questionnaires from their customers. For them the CRA is a reason to approach the topic systematically — not because of one customer, but because of an obligation that applies anyway.
What to do now
- Find out whether you are a manufacturer of a product with digital elements. Most companies concerned have not realised it yet.
- Appoint a responsible person and a deputy. This is the one step that cannot be postponed.
- Publish a contact for reporting vulnerabilities. An hour of work.
- Check whether you can compile a list of products and deployed versions. If not, start there.
The rest — documentation, processes, preparation for 11 December 2027 — has time. What matters now is whether, in the event of an incident, you notice at all that a deadline is running.
Where our role ends
We do not assess product conformity. Where a product requires third-party assessment, it is carried out by a notified body — and we are not one. We do not carry out penetration tests. We prepare the processes with you: vulnerability handling, reporting under Article 14 and technical documentation.
This article is for information only and does not replace legal advice.
Not sure whether you are a manufacturer under the CRA?
In thirty minutes we will tell you whether the Regulation applies to you, what you need to have in place today and what has time until 11 December 2027. No obligation.
Book a no-obligation consultation →
Legal position verified as of 22 October 2026. With legal content, an outdated article is worse than none — if you find a discrepancy, write to us at info@iosec.eu.
Sources
Tell us what you are dealing with.
Thirty minutes with a consultant who knows your industry. The output is a one-page summary with a recommended approach and an indicative scope — we send it to you even if we do not reach an agreement.