[SUMMARY]The EU’s product-security reporting clock is now running: manufacturers need workflows for exploited flaws, severe incidents, and fast evidence-based triage.[/SUMMARY]
[LABELS]Technology, Cybersecurity, Software[/LABELS]
[COVER url="https://drive.google.com/file/d/1gUNbcfvI7Fdp0LN3ir7-JYSdYhXLtWnO/view?usp=drivesdk" alt="Photograph of a data-center server room with rows of computer racks" caption="Rawpixel via CT Mirror; identified as a public-domain CC0 photograph. The image illustrates digital infrastructure, not an EU reporting portal."]
[P]The EU Cyber Resilience Act (CRA) has moved from implementation planning to incident-response reality. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. That is a distinct early phase: most of the Act’s broader product-security obligations do not apply until 11 December 2027. In the meantime, qualifying manufacturers need to be able to identify an in-scope product, assess whether an event meets the trigger, and file rapidly through ENISA’s Single Reporting Platform (SRP). (Regulation (EU) 2024/2847, Articles 14 and 71; European Commission reporting guidance.)[/P]
[H2]A narrow trigger, a short clock[/H2]
[P]The rule does not turn every discovered bug into a regulatory incident. Article 14 covers a vulnerability in a product that the manufacturer becomes aware is actively exploited, and a severe incident with an impact on product security. A severe incident includes one that compromises, or could compromise, protection of important data or functions, or enables malicious code to be introduced or executed in the product or a user’s network and information systems. A flaw found in a routine test, without evidence of active exploitation, is not the same reporting trigger. That distinction makes the quality and speed of triage central.[/P]
[P]The deadlines run from awareness: an early warning is due without undue delay and no later than 24 hours; a fuller notification follows within 72 hours. For an exploited vulnerability, the final report is due within 14 days after a corrective or mitigating measure becomes available. For a severe incident, it is due within one month after the 72-hour notification. Initial filings can be updated as facts develop; the framework allows the coordinating CSIRT to request an intermediate status report. The different final-report clocks matter: one starts when a fix or mitigation exists, the other from the incident notification.[/P]
[H2]One submission, coordinated response[/H2]
[P]Manufacturers submit through the ENISA-operated SRP, once, to the CSIRT designated as coordinator for the Member State where the manufacturer has its main EU establishment, with a statutory fallback for manufacturers without one; the notification is simultaneously accessible to ENISA. The receiving CSIRT can share it with other relevant national CSIRTs. This is a routing mechanism for coordinated response, not a public vulnerability-disclosure portal. Manufacturers must also inform affected users about severe incidents and relevant corrective measures; regulator reporting does not replace customer communication.[/P]
[IMAGE url="https://drive.google.com/file/d/15r0VVSigGXXVH3q7MEVMFzXUiFo3ByMI/view?usp=drivesdk" alt="Cooling towers and backup generators on the roof of a data center" caption="Photo by Rsparks3, Wikimedia Commons, CC0 1.0; a real photograph of data-center cooling and backup-power infrastructure."]
[P]The first practical challenge is product mapping. The CRA covers hardware and software products with digital elements made available in the EU, including products already on the market before the main 2027 date. Yet the Article 14 duty is not synonymous with every obligation in the Act, and open-source software stewards are on a later reporting timetable, beginning 11 December 2027. Teams should not assume either that every software service is in scope or that old products are automatically outside the reporting regime; classification depends on the product and its role.[/P]
[H2]What manufacturers should operationalize now[/H2]
[P]ENISA’s SRP is operational and its guidance includes registration, notification and update workflows. Its page notes a version 1.2.1 upgrade on 20 October 2026, an indication that this is a working reporting process whose user documentation can change. The Commission’s July implementation guidance is non-binding, but offers practical examples to interpret scope and reporting. Because these resources evolve, compliance teams should validate the current workflow instead of relying on a one-off launch checklist.[/P]
[LIST]
- Name an accountable reporting owner and trained backup; register authorized representatives in the SRP.
- Maintain a product inventory linking market availability, software components, support contacts, and EU establishment details.
- Define an escalation path that records when evidence first gives reasonable grounds for awareness, then starts the 24-hour and 72-hour clocks.
- Prepare an initial-notification template and a parallel user-communications process; maintain a record for the later final report.
[/LIST]
[P]This is not just a legal inbox exercise. The reporting sequence forces engineering, product security, legal, and customer-response teams to share a defensible incident timeline while a fix may still be under development. A disciplined process can reduce confusion, but reporting itself does not establish that a vulnerability is fixed or that a product is compliant with the CRA’s later full requirements. With the first deadline phase live, the useful question for a manufacturer is no longer whether to prepare, but whether its organization can recognize the trigger and submit a credible first account in time.[/P]
[REFERENCES]
- Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847 | European Parliament and Council, Official Journal of the European Union & 2024
- Cyber Resilience Act - Reporting obligations | https://digital-strategy.ec.europa.eu/en/policies/cra-reporting | European Commission & 2026
- Single Reporting Platform (SRP) | https://www.enisa.europa.eu/topics/product-security/vulnerability-services/eu-incident-response-and-cyber-crisis-management/single-reporting-platform-srp | ENISA & 2026
- Commission publishes new guidance to support timely Cyber Resilience Act implementation | https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation | European Commission & 2026
- Cyber Resilience Act | https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act | European Commission & 2026
- EU Cyber Resilience Act: 24-Hour Reporting Duties Start September 11, 2026 | https://www.jonesday.com/en/insights/2026/07/eu-cyber-resilience-act-24hour-reporting-duties-start-september-11-2026 | Jones Day & 2026
- The EU Cyber Resilience Act: Preparing for the New Reporting Obligations for “Products With Digital Elements” | https://www.kirkland.com/publications/kirkland-alert/2026/09/the-eu-cyber-resilience-act | Kirkland & Ellis & 2026
[/REFERENCES]
Editorial Dispatch
·