EU Cyber Resilience Act Incident Reporting Requirements Now in Effect

• •The EU Cyber Resilience Act mandates incident reporting for digital product manufacturers.
• •Reporting requirements include notifications for actively exploited vulnerabilities within 24 hours.
• •The CRA aims to harmonize cybersecurity standards across EU Member States.

As of September 11, 2026, the EU Cyber Resilience Act (CRA) mandates incident reporting for manufacturers of products with digital elements. This includes a structured notification process to the EU Member State CSIRT and ENISA for actively exploited vulnerabilities and severe incidents. The CRA aims to enhance cybersecurity standards across the EU, requiring manufacturers to report vulnerabilities within 24 to 72 hours and provide final reports within 14 days after a fix is available. The CRA applies to all connected products, affecting manufacturers, importers, and distributors regardless of their location. The Act was published in November 2024 and will fully apply by December 11, 2027, but the reporting obligations are already in effect. This regulatory framework is designed to protect users and ensure accountability from manufacturers.