What is the Cyber Resilience Act and when does it apply?
The Cyber Resilience Act (CRA, EU Regulation 2024/2847) is an EU regulation that sets horizontal, i.e. cross-sector, cybersecurity requirements for all products with digital elements, meaning devices and software that exchange data with the internet or other devices, from routers to smart-home gadgets. The regulation becomes fully applicable on December 11, 2027. It does not come into force all at once. The reporting and notification obligations for manufacturers of products with digital elements become applicable on September 11, 2026, more than a year before the regulation fully applies on December 11, 2027. Ignoring this deadline risks failing to meet the requirements in time.
This article explains what will be required from September 2026, which companies are affected, and how you can integrate preparation into your processes now. Our goal is practical guidance, not legal jargon.
What must manufacturers report from September 11, 2026?
From September 11, 2026, only the obligation to report actively exploited vulnerabilities in products with digital elements (Article 24 of the regulation) applies. The obligation to report serious security incidents (Article 25) follows on December 11, 2026. Both reports go to the European Union Agency for Cybersecurity (ENISA), which collects and coordinates incidents at EU level, and to the relevant Computer Security Incident Response Team (CSIRT) in the member state, the national emergency unit for IT-security incidents.
The deadlines are staggered:
- Initial alert: within 24 hours of becoming aware, to ENISA and CSIRT
- Detailed report: after 72 hours
- Final report: after 14 days
These staggered deadlines require a structured reporting process that works immediately in an emergency.
The reporting obligations are part of Chapter II (Section 3) of the regulation. As of June 2026, Chapter IV of EU Regulation 2024/2847 becomes relevant, initially for the notification of conformity assessment bodies, i.e. state-recognised bodies that check whether a product meets the CRA's requirements, and from September 11, 2026, operationally for manufacturers' reporting obligations.
Who is affected by the CRA reporting obligations?
The CRA reporting obligations apply to manufacturers, importers, and distributors of products with digital elements placed on the EU market, including non-EU companies, which must appoint an EU-based authorized representative. The scope is deliberately broad: It applies to all products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. This includes not only classic hardware such as routers or smart home devices but also software and embedded systems.
The obligations apply to manufacturers, importers, and distributors. Market access is the deciding factor: Companies established outside the European Union are also affected if they place products on the EU market. They must appoint an authorized representative in the EU to handle communication with authorities.
In Germany, the Federal Office for Information Security (BSI), Germany's cybersecurity authority, monitors compliance with the CRA. The BSI is also the central point of contact for reports from German manufacturers.
How should you prepare now?
Preparation for the 24-hour reporting deadline requires four concrete steps: product inventory with SBOM, vulnerability management, defined reporting channels plus a dry-run exercise, and early ENISA account verification. If you want to meet the 24-hour deadline, you cannot start organizing when an incident occurs. Preparation involves several concrete steps you should address now.
- Create a product inventory and SBOM: Record all products with digital elements that you manufacture or place on the EU market. For each product, you should record which components and dependencies it contains. A software bill of materials (SBOM) lists all software components and allows you to quickly check whether your product is affected when a vulnerability becomes known. See our SBOM guide for details.
- Establish vulnerability management: You need procedures to identify, assess, and remediate vulnerabilities in your products. This includes monitoring security information, such as advisories from component manufacturers. Our vulnerability management service article shows how to set this up.
- Define reporting channels and conduct an emergency exercise: Define internally who is responsible for reporting and what information is needed. Establish how you assess the severity of an incident and which criteria trigger a report. Test the process with an exercise before an actual emergency occurs.
ENISA published guidance on reporting on August 14, 2026. It contains practical advice on using the reporting portal. Note that an unverified account is limited to ten reports. Verifying your account early is therefore advisable.
Timeline until December 2027
The CRA timeline: September 11, 2026, reporting obligations for actively exploited vulnerabilities (Art. 24); December 11, 2026, reporting obligations for incidents (Art. 25); December 11, 2027, full applicability with SBOM obligation. The reporting obligations are not an isolated event. They are the first operational part of the CRA, followed by full applicability in December 2027. Comprehensive cybersecurity requirements for products will then apply, including the obligation to create an SBOM and extended documentation duties.
Many processes you build for the reporting obligations will also be needed for later conformity. Your product inventory is the basis for risk assessment. Vulnerability management is the foundation for post-market monitoring, i.e. the ongoing observation of products after market launch for security issues, which becomes mandatory in 2027. Investing now creates a solid basis for the next steps.
The minimum support period for products is generally five years. During this time, you must provide security updates and remediate vulnerabilities. You should also consider this requirement in product planning.
A roadmap for CRA implementation typically includes six phases: product inventory, risk assessment, implementation of security measures, documentation, conformity assessment, and post-market monitoring. The reporting obligations mainly concern the first and last phases, namely inventory and monitoring. You should prioritize these phases now.
Conclusion: The CRA as a driver for a stronger security culture
The CRA is an opportunity to professionalize your security posture. Companies that invest in vulnerability management and reporting processes now improve not only their compliance but also their product quality and risk management. The reporting obligations enforce a transparency that builds trust in the long term.
Preparation for September 2026 is manageable if you proceed in a structured way. Start with the inventory, establish vulnerability management, and define reporting channels. Time until the deadline is short but sufficient if you act now.
Companies that treated the CRA as a distant topic now face concrete operational requirements. The good news: Most measures are sensible anyway, regardless of regulation. A company that knows its products and their vulnerabilities is better positioned, no matter what comes.
The Cyber Resilience Act closes a gap in existing Union law. Until now, there was no horizontal legal framework for cybersecurity requirements covering all products with digital elements. The CRA changes this and sets a common standard. We support companies in implementation and help integrate the requirements into existing processes. The reporting obligations from September 2026 are the first step on this path.