The Cyber Resilience Act ("CRA")1 introduces uniform cybersecurity requirements for products with digital elements across the European Union for the first time. While the majority of the regulations will not come into effect until December 11, 2027, the reporting obligations under Art. 14 CRA have already been applicable since September 11, 2026.
Since then, manufacturers have been required to report actively exploited vulnerabilities and significant incidents that impact the security of their products with digital elements. A particularly short deadline applies to these reports: the initial notification must be submitted within 24 hours of becoming aware of the issue.
With the Cyber Resilience Act (CRA), the European Union has for the first time established comprehensive, directly applicable cybersecurity requirements for products with digital elements. The regulation aims to improve the cybersecurity level of hardware and software products and to set a uniform legal framework for essential cybersecurity requirements for placing products with digital elements on the market. This is intended to ensure that security aspects are considered from the development stage throughout the entire product lifecycle.2
The scope of application is broad. In principle, it covers products that are connected, either directly or indirectly, to another device or network. This includes, for example, software, operating systems, hardware products, connected devices, and certain components. It also encompasses consumer products with digital elements intended for vulnerable consumers, such as toys and baby monitor systems. Furthermore, smart household appliances with security functions or smartphones also fall within the scope of the CRA.3
For manufacturers, the CRA entails, in particular, new requirements for the planning, development, production, and maintenance of their products.
The specific obligations vary depending on the respective product category—distinguishing between general, important, and critical products—4 as well as the role of the respective market participant, such as manufacturer, importer, or distributor.
While most provisions of the CRA are not applicable until December 11, 2027, the reporting obligations for manufacturers under Art. 14 CRA have been in effect since September 11, 2026. Consequently, manufacturers must be prepared for the short statutory reporting deadlines today.5
According to the CRA, a manufacturer is any natural or legal person who develops or manufactures products with digital elements, or who has products with digital elements designed, developed, or manufactured and markets them under their own name or trademark, whether for payment, for monetization, or free of charge.6 The scope of the CRA is therefore not limited to companies in the software industry. Instead, it generally covers all companies that provide software to third parties, regardless of whether this provision is made for a fee or free of charge.
The reporting obligations under Art. 14 of the CRA are triggered by two different events: first, actively exploited vulnerabilities in a product with digital elements, and second, significant incidents that impact the security of the product.
For actively exploited vulnerabilities, Art. 14 of the CRA stipulates a three-stage reporting procedure.
First, the manufacturer must submit an early warning notification. This must be transmitted without undue delay and, in any case, within 24 hours of becoming aware of the issue. The notification must specify, in particular, the Member States in which the product in question has been made available, to the best of the manufacturer's knowledge. The early warning notification is intended for initial, timely information and does not require a complete technical analysis of the vulnerability to have been finalized.
Authorities that must be informed:
Both the competent national Computer Security Incident Response Team (CSIRT) and the European Union Agency for Cybersecurity (ENISA) must be informed.
In Austria the responsible body is GovCERT Austria which is based at the Federal Ministry of the Interior, Department IV/S/2 – Network and Information Systems Security. It can be reached at Herrengasse 7, 1010 Vienna, by phone at +43 1 531 26-0, or via email at post@nis.gv.at . Further information can be found on the website at www.govcert.gv.at.
The European Union Agency for Cybersecurity (ENISA) is headquartered in Athens, Greece, with offices in Heraklion and Brussels. It can be reached at Agamemnonos 14, Chalandri 15231, Attiki, Greece, by phone at +30 28 14 40 9711, or via email at info@enisa.europa.eu . Further information can be found on the website at www.enisa.europa.eu.
Within 72 hours of becoming aware of the issue, a more detailed vulnerability notification must be submitted. This must include—where available—general information about the affected product, the nature of the exploitation and the vulnerability, as well as any corrective and mitigation measures already taken or planned.
Article 14 of the CRA thus distinguishes between the initial early warning within 24 hours and the more detailed notification within 72 hours.
Finally, a final report must be submitted. This must be filed no later than 14 days after a corrective or mitigation measure becomes available. The final report must include, among other things, a description of the vulnerability, including its severity and impact, as well as—where available—information about the attacker and the security updates or other corrective measures provided for remediation.
A distinction must be made between the notification obligation for actively exploited vulnerabilities and the notification obligation for significant security incidents, which have an impact on the security of a product with digital elements .
For such incidents, Article 14 of the CRA also provides for a multi-stage notification procedure :
The manufacturer must first submit an early warning notification within 24 hours of becoming aware of the incident. This is followed within 72 hours by a more detailed notification containing further information about the security incident.
The essential difference compared to the reporting obligation for actively exploited vulnerabilities lies in the final report: while this must be submitted no later than 14 days after a patch or mitigation measure becomes available for an actively exploited vulnerability, the final report for a serious security incident must be submitted within one month of the
72-hour notification.
While the two reporting obligations differ in terms of the triggering event and the deadline for the final report, they follow a comparable basic structure regarding the manufacturer's initial response: an early warning within 24 hours, a follow-up report within 72 hours, and a subsequent final report.
The reporting obligations under Article 14 of the CRA, which have been applicable since September 11, 2026, challenge manufacturers to manage security incidents not only technically, but also organizationally and legally. In particular, the short 24-hour deadline requires clear responsibilities, established processes, and appropriate communication channels to ensure immediate and legally compliant reporting when an incident occurs.
1 Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act – CRA).
2 Recital (2) CRA.
3 Recital (10) CRA.
4 For details, see Article 3 (products with digital elements), Article 7 (important products with digital elements), and Article 8 (critical products with digital elements) of the CRA.
5 Recital (126) CRA; provisions regarding the notification of conformity assessment bodies have also been in effect since June 11, 2026.
6 Article 3(13) CRA.
