CRA reporting obligations from September 2026

Under Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, manufacturers must report actively exploited vulnerabilities and severe incidents on a fixed timeline: an early warning within 24 hours, a fuller notification within 72 hours, and a final report later. These reporting obligations apply from 11 September 2026, earlier than most of the CRA's other requirements, so reporting readiness is the first deadline manufacturers actually meet.

The Article 14 timeline

Once you become aware of an actively exploited vulnerability in your product, or a severe incident having an impact on the security of the product, the clock starts:

Early warning within 24 hours. A first notification that flags the event.
Notification within 72 hours. A fuller account of the vulnerability or incident, including relevant details known at that point.
Final report. For vulnerabilities, within 14 days of a corrective or mitigating measure becoming available. For incidents, within one month of the notification.

The 24-hour and 72-hour steps run from the moment you become aware of the event, so your internal detection and triage need to be quick enough to leave time for a considered submission.

Who receives the report

Reports go to the authorities through a single channel. You submit simultaneously to the coordinator CSIRT designated as coordinator and to ENISA, via the single reporting platform established under Article 16. Submitting to one place that fans out to the right recipients is the design intent, so build your process around that platform rather than around bilateral contacts.

What triggers a report

Two categories trigger the Article 14 timeline:

An actively exploited vulnerability contained in the product with digital elements, meaning a vulnerability that is being used in an attack rather than one that is merely theoretical.
A severe incident having an impact on the security of the product with digital elements.

Not every discovered vulnerability triggers a mandatory report. The obligation is tied to active exploitation and to severe incidents, so your triage should quickly distinguish a routine vulnerability, handled through your normal disclosure process, from one that meets the reporting threshold.

Getting ready

Reporting readiness is an operational capability, not a document. You need monitoring that surfaces exploitation quickly, a decision path that can classify an event within hours, named people who can submit through the single reporting platform at any time, and a template that captures what the 72-hour notification needs. Rehearse it before September 2026 rather than discovering the gaps during a live event.

How CRANIS2 helps

CRANIS2 keeps your reporting readiness in one place: it links vulnerabilities to the products they affect, tracks the 24-hour, 72-hour and final-report clocks, and holds the evidence you would submit so you are not assembling it under pressure. Work through your gaps with our incident readiness checklist.

Frequently asked questions

When do the CRA reporting obligations start?

The Article 14 reporting obligations apply from 11 September 2026. This is ahead of the CRA's main obligations, which apply from 11 December 2027.

Do the reporting obligations apply to older products?

Yes. Under the transitional rule in Article 69, products placed on the market before 11 December 2027 fall under the full requirements only if substantially modified after that date, but the reporting obligations apply regardless.

Can a small company be fined for missing the 24-hour deadline?

No. Microenterprises and small enterprises cannot be fined for missing the 24-hour reporting deadline. The obligation still applies, but that particular penalty is carved out for them.