Starting September 11, 2026, manufacturers of digital products across the EU must report actively exploited security vulnerabilities and severe incidents to authorities within 24 hours of discovery, marking the first major enforcement test of Europe's cybersecurity framework. The EU Cyber Resilience Act (CRA), which entered into force in December 2024, has now activated its mandatory reporting obligations, fundamentally changing how companies must respond to security threats.

What Are the New Reporting Requirements Under the EU Cyber Resilience Act?

The CRA imposes strict timelines on manufacturers, importers, and distributors throughout the digital product lifecycle. Under Article 14 of the regulation, manufacturers must report two categories of incidents: any actively exploited vulnerability in their digital product and any severe incident that compromises product security. Importantly, these obligations apply even after a product's support period has ended.

The reporting process unfolds in three stages. First, manufacturers must send an "early warning notification" without undue delay and within 24 hours of becoming aware of the vulnerability or incident. The European Commission's July 2026 guidance clarifies that a manufacturer is deemed to have "become aware" when, after an initial assessment, it has reasonable certainty that a vulnerability is being actively exploited or a severe incident has occurred.

Second, unless information has already been provided, a "vulnerability notification" must follow within 72 hours of awareness. This notification should detail mitigation measures and the sensitivity level of the information. Third, a final report must be submitted within 14 days for vulnerabilities or one month for severe incidents, containing detailed descriptions, severity assessments, information about malicious actors if available, and details about security updates or corrective measures.

How to Prepare Your Organization for CRA Compliance

• Establish Monitoring Systems: Deploy robust monitoring and incident response processes to detect vulnerabilities and severe incidents immediately, ensuring you can assess situations and determine awareness status within the required timeframe.
• Create Reporting Protocols: Develop clear procedures for notifying the Computer Security Incident Response Team (CSIRT) in your member state and ENISA, as well as affected users, following the three-stage reporting timeline with no grace period for delays.
• Engage Regulators Proactively: Establish relationships with relevant regulatory bodies and ensure your organization understands the risk-based approach to user notification, particularly for products used in sensitive or essential environments where broader disclosure could increase cybersecurity risks.

Reports must be submitted to the Computer Security Incident Response Team (CSIRT) in the member state where the manufacturer has its main establishment and to ENISA, the EU's cybersecurity agency. In Ireland, for example, the CSIRT is operated by the National Cyber Security Centre. Manufacturers must also notify impacted users, though the CRA's risk-based approach means information does not need to be made public indiscriminately, particularly for sensitive applications.

The lack of any grace period for these obligations means organizations must be ready immediately. The European Commission's guidance emphasizes that "prompt action from the outset of any potential vulnerability or incident being detected is essential". For many organizations, this represents the first real enforcement test of the CRA, creating significant compliance pressure.

Why Does This Matter for European Tech Companies and Beyond?

The CRA reporting requirements overlap with other EU digital regulations, making compliance complex for manufacturers operating across multiple jurisdictions. Organizations must ensure their incident response capabilities can meet the 24-hour early warning deadline while simultaneously managing investigations and developing mitigation strategies. The stakes are high: failure to comply could result in regulatory enforcement action and reputational damage.

This development arrives as Europe grapples with broader questions about its technological independence and competitiveness. While the EU has implemented strong regulatory frameworks like the CRA and the AI Act, European companies face challenges in scaling and competing globally. The cybersecurity reporting requirements represent Europe's commitment to building trustworthy digital infrastructure, even as the continent struggles to develop world-class technology companies that can rival American and Chinese competitors.

The timing is significant: Europe's AI transparency rules are also now live, and the EU Commission has published a comprehensive cybersecurity and AI action plan. These overlapping regulatory initiatives reflect Brussels' determination to establish Europe as a leader in responsible technology governance, even if the continent lags in frontier AI innovation and computing infrastructure.

For manufacturers, the message is clear: robust incident response processes are no longer optional. The CRA's 24-hour reporting deadline means organizations must treat cybersecurity not just as a technical concern but as a business-critical function requiring immediate executive attention and cross-functional coordination.