What triggers a report
Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) sets two triggers:
- An actively exploited vulnerability in your product - there is reliable evidence that someone has exploited it.
- A severe incident that affects the security of your product - for example one that compromises the integrity of your update mechanism or the data your product processes.
The obligation applies to products already on the market, not only to new ones, and it does not depend on company size.
The deadlines
| Actively exploited vulnerability | Severe incident | |
|---|---|---|
| Early warning | within 24 hours of becoming aware | within 24 hours of becoming aware |
| Notification | within 72 hours of becoming aware | within 72 hours of becoming aware |
| Final report | at the latest 14 days after a corrective or mitigating measure is available | within one month after the notification |
The clock starts when you become aware - which is why knowing what is inside every release you ship matters.
Who receives the reports
Reports are submitted through the single reporting platform run by ENISA, the EU cybersecurity agency. They reach the CSIRT designated as coordinator in the member state of your main establishment, and ENISA. You must also inform affected users about the vulnerability or incident and the measures they can take.
What else the CRA expects
- Security updates for the expected lifetime of the product - in most cases at least five years.
- A policy and a contact point for coordinated vulnerability disclosure.
- A software bill of materials and documented handling of every vulnerability.
- Technical documentation and an EU declaration of conformity, kept for ten years.
From 11 December 2027 all requirements apply, and products without CRA conformity can no longer be placed on the EU market.
How Kernwatch helps
- Flags components with known exploited vulnerabilities in the releases you support and puts a task in your action inbox to open a reporting case.
- Opens the case with the 24-hour, 72-hour and final-report deadlines and reminds the right people in time.
- Drafts the early warning, the notification and the final report from your product, release and triage data for your review and sign-off.
- Helps you file: copy the signed-off text, open the ENISA platform, submit it there and record the reference and receipt in Kernwatch. ENISA's platform has no API for manufacturers, so Kernwatch cannot submit for you.
- Detects the fix: when a newer release no longer contains the vulnerable version, it proposes the corrective-measure date that starts the 14-day final-report clock.
- Informs users after your approval - an email to the product's customer contacts and, on Professional, the published advisory - and records who was informed, and when.
Official sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex
- Cyber Resilience Act, European Commission
- ENISA - EU Agency for Cybersecurity
This page summarises Regulation (EU) 2024/2847 for orientation and is not legal advice.