CRA: vulnerability and incident reporting is now mandatory

Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, launched the same day. Deadlines: early warning within 24 hours, notification within 72 hours, final report within 14 days after a fix is available (vulnerabilities) or within one month (incidents).

What it means: the duty also covers products placed on the market before December 2027. Software vendors need vulnerability monitoring, fast triage and a notification workflow. The other CRA requirements apply from 11 December 2027.

Source: European Commission, ENISA. Read on the Cyberbits regulatory watch · Book a free 30-min call