# CRA reporting obligations, explained

Since **11 September 2026**, every manufacturer of a product with digital elements on the EU market must report actively exploited vulnerabilities and severe incidents - within hours, not weeks.

Source: https://kernwatch.com/cra-reporting · Last updated: 2026-10-17

## Key facts

- The Cyber Resilience Act is Regulation (EU) 2024/2847; it entered into force on 10 December 2024.
- Reporting obligations (Article 14) apply from 11 September 2026, also to products already on the market.
- Actively exploited vulnerability: early warning within 24 hours, notification within 72 hours, final report within 14 days after a fix is available.
- Severe incident: early warning within 24 hours, notification within 72 hours, final report within one month.
- Reports go through ENISA's single reporting platform to the coordinating CSIRT and to ENISA.
- All other CRA requirements apply from 11 December 2027; fines reach up to €15 million or 2.5 % of worldwide annual turnover.

## What triggers a report

Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) sets two triggers:

- **An actively exploited vulnerability** in your product - there is reliable evidence that someone has exploited it.

- **A severe incident** that affects the security of your product - for example one that compromises the integrity of your update mechanism or the data your product processes.

The obligation applies to products already on the market, not only to new ones, and it does not depend on company size.

## The deadlines

|  | Actively exploited vulnerability | Severe incident |
|---|---|---|

| Early warning | within 24 hours of becoming aware | within 24 hours of becoming aware |

| Notification | within 72 hours of becoming aware | within 72 hours of becoming aware |

| Final report | at the latest 14 days after a corrective or mitigating measure is available | within one month after the notification |

The clock starts when you become aware - which is why knowing what is inside every release you ship matters.

## Who receives the reports

Reports are submitted through the **single reporting platform run by ENISA**, the EU cybersecurity agency. They reach the CSIRT designated as coordinator in the member state of your main establishment, and ENISA. You must also inform **affected users** about the vulnerability or incident and the measures they can take.

## What else the CRA expects

- Security updates for the expected lifetime of the product - in most cases at least five years.

- A policy and a contact point for coordinated vulnerability disclosure.

- A software bill of materials and documented handling of every vulnerability.

- Technical documentation and an EU declaration of conformity, kept for ten years.

From **11 December 2027** all requirements apply, and products without CRA conformity can no longer be placed on the EU market.

## How Kernwatch helps

- Flags components with known exploited vulnerabilities in the releases you support and puts a task in your action inbox to open a reporting case.

- Opens the case with the 24-hour, 72-hour and final-report deadlines and reminds the right people in time.

- Drafts the early warning, the notification and the final report from your product, release and triage data for your review and sign-off.

- Helps you file: copy the signed-off text, open the ENISA platform, submit it there and record the reference and receipt in Kernwatch. ENISA's platform has no API for manufacturers, so Kernwatch cannot submit for you.

- Detects the fix: when a newer release no longer contains the vulnerable version, it proposes the corrective-measure date that starts the 14-day final-report clock.

- Informs users after your approval - an email to the product's customer contacts and, on Professional, the published advisory - and records who was informed, and when.

## Official sources

- [Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/2847/oj)
- [Cyber Resilience Act, European Commission](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)
- [ENISA - EU Agency for Cybersecurity](https://www.enisa.europa.eu/)

This page summarises Regulation (EU) 2024/2847 for orientation and is not legal advice.