EU CRA Vulnerability Reporting Rules Take Effect September 11

A major compliance milestone under the EU Cyber Resilience Act (CRA) is approaching.

Beginning September 11, 2026, manufacturers will be required to comply with mandatory vulnerability and cybersecurity incident reporting obligations under the CRA. For companies selling connected devices, software, and other products with digital elements in the European Union, this is one of the most immediate compliance requirements under the regulation.

 

The reporting obligations apply broadly to relevant products made available on the EU market, making early preparation essential for manufacturers and exporters that sell digital or connected products across EU member states.

 

Under Articles 14 and 71 of the Cyber Resilience Act, together with the applicable transitional provisions, manufacturers that become aware of an actively exploited vulnerability or a serious security incident affecting a product will be required to report the issue through the EU's designated reporting system.

 

The single reporting platform operated by the European Union Agency for Cybersecurity, or ENISA, is also scheduled to become operational on September 11, 2026. Reports submitted through the platform will be made available to the relevant EU authorities and national Computer Security Incident Response Teams (CSIRTs).

CRA Vulnerability Reporting Follows Strict Deadlines

One of the most important aspects of CRA vulnerability reporting is its strict timeline. Companies cannot wait until an internal investigation is complete before notifying authorities.

Manufacturers will need to manage three key reporting stages.

1. Early Warning Within 24 Hours

Manufacturers must submit an early warning within 24 hours after becoming aware of an actively exploited vulnerability or qualifying cybersecurity incident.

The purpose of this initial notification is to alert the relevant authorities as quickly as possible so the potential security risk can be assessed and monitored.

 

2. Full Notification Within 72 Hours

Within 72 hours of becoming aware of the issue, the manufacturer must provide a more detailed notification.

This report should include available information about the vulnerability or incident, a preliminary assessment of its severity and impact, and details of any corrective or mitigation measures already taken.

 

For companies operating across multiple EU markets, the short reporting window means that internal security, compliance, legal, and product teams will need clearly defined responsibilities before an incident occurs.

 

3. Final Report After Investigation and Remediation

A final report must then be submitted according to the nature of the security issue.

For an actively exploited vulnerability, the final report generally needs to be completed within 14 days after a corrective or mitigating measure becomes available.

 

For a serious cybersecurity incident, the final report is generally required within one month of the initial incident notification.

 

These deadlines make it increasingly important for companies to establish formal procedures for vulnerability identification, risk assessment, incident escalation, remediation, and regulatory reporting.

 

EU Issues Guidance to Help Companies Prepare

To support implementation, the European Commission has released guidance addressing the reporting process, assessment criteria, and remediation requirements.

 

The guidance is intended to help businesses of different sizes understand how the new rules should be applied in practice and provides an important reference point for companies developing their internal EU product compliance procedures.

 

Exporters should not treat CRA compliance as a responsibility limited to their IT departments. Product development teams, compliance personnel, legal teams, customer support teams, and senior management may all need to participate in the response process when a reportable vulnerability is identified.

 

The Cyber Resilience Act Is Being Implemented in Stages

The EU Cyber Resilience Act entered into force on December 10, 2024, but its requirements were not designed to become mandatory all at once.

 

Instead, the European Union established a phased implementation schedule.

Certain provisions related to conformity assessment bodies and regulatory oversight became applicable on June 11, 2026.

 

The next major milestone arrives on September 11, 2026, when the vulnerability and incident reporting requirements take effect.

The CRA will then become fully applicable on December 11, 2027, when the broader transition period comes to an end.

 

At that point, companies covered by the regulation will need to comply with the full range of cybersecurity requirements, including secure product design and development, secure-by-default configurations, vulnerability management, security updates, conformity assessment procedures, CE marking, technical documentation requirements, and cooperation with market surveillance authorities.

 

What Products Are Covered by the CRA?

The CRA establishes a horizontal cybersecurity framework for products with digital elements placed on the EU market.

 

Its scope includes a wide range of software and hardware products capable of connecting directly or indirectly to a device or network.

Examples may include:

• Smart home devices
• Wearable technology
• Connected toys
• Consumer software applications
• Smart appliances
• Internet-connected electronics
• Other hardware and software products with digital components

For manufacturers and exporters, this broad scope means EU product compliance should be assessed well before products are shipped or launched in European markets.

 

The core objective of the regulation is to address longstanding cybersecurity weaknesses in connected products, particularly situations in which devices remain on the market without adequate security maintenance or vulnerability remediation.

Rather than focusing only on cybersecurity at the point of sale, the CRA introduces security responsibilities throughout the product lifecycle.

 

What Exporters Should Do Before September 11

For companies manufacturing or selling smart devices, connected electronics, software, or other digital products in the EU, the September reporting requirements should be treated as an immediate compliance priority.

 

Businesses should review their existing cybersecurity processes and establish a structured system covering:

• Vulnerability identification and monitoring
• Internal incident escalation
• Cybersecurity risk assessment
• Regulatory reporting responsibilities
• Remediation and mitigation procedures
• Product security records
• Technical documentation
• Communication between product, compliance, and management teams

Companies should also determine in advance who is responsible for deciding whether an issue meets the CRA reporting threshold and who will submit the required information through the ENISA platform.

 

Because the first reporting deadline can arrive only 24 hours after a company becomes aware of a qualifying issue, these responsibilities should not be determined after an incident has already occurred.

 

Noncompliance Can Lead to Significant Penalties

The financial and commercial consequences of CRA violations can be substantial.

 

Companies that fail to meet applicable obligations, submit required reports late, omit reportable incidents, or fail to take appropriate corrective action may face enforcement measures from EU market surveillance authorities.

 

Depending on the violation, authorities may require corrective action, restrict or prohibit products from being sold, order products to be withdrawn from the market, or require recalls.

Administrative fines for certain violations can reach €15 million or 2.5% of the company's total worldwide annual turnover, whichever amount is higher.

 

For businesses that rely heavily on European sales, the potential consequences extend well beyond the fine itself. Product suspensions, recalls, and market restrictions can disrupt distribution networks, inventory planning, customer relationships, and long-term access to the EU market.

 

Conclusion: CRA Compliance Is Becoming an Operational Requirement

The September 11 reporting deadline marks an important shift in the implementation of the EU Cyber Resilience Act. Cybersecurity compliance is moving from long-term preparation to day-to-day operational responsibility for companies selling products with digital elements in Europe.

 

Manufacturers should not view CRA vulnerability reporting simply as a regulatory filing requirement. Meeting the 24-hour and 72-hour deadlines requires an internal system capable of detecting vulnerabilities, assessing their significance, escalating incidents quickly, documenting corrective actions, and coordinating regulatory reporting across multiple teams.

 

Companies exporting connected or digital products to Europe should therefore review both cybersecurity readiness and broader EU product compliance before their goods enter the market. Compliance planning should be integrated into product development, documentation, supply chain management, and market-entry decisions rather than handled only after a security issue emerges.

 

For businesses sourcing products in China and selling across European markets, regulatory preparation is only one part of managing a reliable international supply chain. Forest Shipping is a China-based freight forwarder providing international shipping solutions from China to EU countries, including ocean freight, air freight, customs clearance, and door-to-door transportation.

 

As EU regulations continue to place greater emphasis on product compliance and supply chain accountability, coordinating compliance preparation with shipping and import planning can help businesses reduce avoidable disruptions and move goods into European markets more efficiently.