As of September 11, 2026, manufacturers of products with digital elements are subject to new incident reporting obligations under the EU Cyber Resilience Act (“CRA”). Products with digital elements include products that can be connected, directly or indirectly, to a device or network. This can include a wide range of connected consumer products and related apps.

The CRA entered into force on December 10, 2024. While the CRA’s main substantive obligations will apply from December 11, 2027, the incident reporting obligations take effect on September 11, 2026. Under such obligations, manufacturers are required to notify actively exploited vulnerabilities and severe incidents affecting the security of their products. This reporting obligation is one of the CRA’s first operational compliance requirements to take effect and is intended to support faster information sharing among relevant EU cybersecurity authorities.

Under the CRA, manufacturers that become aware of an actively exploited vulnerability or a severe incident with an impact on the security of a product with digital elements must follow a staged reporting process. The reporting timelines are as follows:

• Early Warning: An early warning notification must be submitted within 24 hours of awareness.
• Full Notification: A full notification must be submitted within 72 hours of awareness.
• Final Report: A final report must be submitted within 14 days after a corrective measure becomes available in the case of an actively exploited vulnerability, and within one month in the case of a severe incident.

The CRA provides for a single reporting channel rather than multiple parallel submissions. Manufacturers must report through the CRA Single Reporting Platform. The notification is directed to the Computer Security Incident Response Team (“CSIRT”) of the EU Member State where the manufacturer has its main establishment and, except in particularly exceptional circumstances, the information is also made available to the EU Agency for Cybersecurity (“ENISA”). The CSIRT that first receives the notification is then expected to share the notification, without delay, with the CSIRTs in the other EU Member States where the affected product with digital elements has been made available.

The reporting framework includes a limited mechanism for delaying broader dissemination. In exceptional and duly justified circumstances, a CSIRT may decide to postpone sharing information with other CSIRTs on cybersecurity-related grounds. The European Commission addressed this issue in a delegated act adopted on December 11, 2025, which further specifies the terms and conditions for invoking those cybersecurity-related grounds. These include situations where immediate dissemination could itself create security concerns or where there are concerns about the ability to ensure the confidentiality of the notified information.

On July 27, 2026, the European Commission published guidance on the CRA to assist organizations in complying with the mandatory cybersecurity requirements for products with digital elements and the related reporting obligations. For further information, read our previous blog post on the European Commission’s guidance on the Cyber Resilience Act.

Read the press release.

Read ENISA’s press release for the SRP.