EU CRA Vulnerability Reporting Live: 24-Hour Early Warning, ENISA Single Reporting Platform Online
From 11 September 2026, EU Cyber Resilience Act reporting obligations apply. Manufacturers must file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a full notification within 72 hours, via ENISA's Single Reporting Platform.
From 11 September 2026, reporting obligations under the EU Cyber Resilience Act (CRA) apply. Manufacturers placing products with digital elements on the EU market must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a full notification within 72 hours, and must file through the EU Agency for Cybersecurity (ENISA) Single Reporting Platform (SRP). The platform went live the same day as the obligation.
Overview
- Legal basis: Regulation (EU) 2024/2847; reporting is Article 14; the platform is Article 16;
- Dates: reporting obligations apply from 11 September 2026; main CRA conformity obligations apply from 11 December 2027;
- Who: manufacturers of products with digital elements; reporting obligations for open-source software stewards apply from 11 December 2027;
- Scope: all products with digital elements made available on the EU market, including products already on the market before the regulation applied.
ENISA stood up SRP initial operating capability the same day, so manufacturers file once and reach multiple parties. The European Commission published implementing-act guidance in parallel.
Rules and Deadlines
CRA Article 14 sets staged clocks:
- 24 hours: early warning from the moment the manufacturer becomes aware;
- 72 hours: full notification;
- 14 days: for actively exploited vulnerabilities, final report within 14 days after a corrective or mitigating measure is available;
- 1 month: for severe incidents, final report within 1 month after the 72-hour notification.
Two reportable classes: actively exploited vulnerabilities — reliable evidence that a malicious actor has exploited them; and severe incidents — incidents with serious impact on product security affecting availability, authenticity, integrity, or confidentiality. Single path: manufacturer files via SRP; the system routes to the CSIRT designated by the Member State of the manufacturer's main establishment and copies ENISA; the receiving CSIRT distributes to CSIRTs of other Member States where the product is made available. Manufacturers outside the EU: the authorised representative's location determines the CSIRT.
`Reporting deadlines (from "awareness")
24h → early warning
72h → full notification
14d → final report (actively exploited vulnerability, after mitigating measure available)
1 month → final report (severe incident, after 72h notification)`Impact
Reporting landed more than a year ahead of other conformity duties, and it covers in-market stock. Direct hit for hardware, IoT, and software vendors exporting to the EU: the 24-hour clock starts at awareness, not at platform registration. Manufacturers must pre-identify the CSIRT and have an internal vuln-triage and notification process that can start inside a day.
Industry view: SRP gives ENISA a single actively-exploited picture across the internal market. Member-state silos go away. Actively exploited vulns and severe incidents sync faster between CSIRTs; attacker window shrinks. Notice also: manufacturers need not report vulnerabilities they already knew were actively exploited before 11 September 2026.
Compliance
- Inventory products placed on the EU market, including in-sale stock SKUs;
- Pre-identify the Member State CSIRT by main establishment. Do not look it up under the clock;
- Stand up 24h / 72h / 14d internal response. Name owners for triage, severity, and approval;
- Register on ENISA's CRA SRP page. Read the FAQ, glossary, and training material;
- Use Commission CRA implementing guidance section 9.1 and the implementing FAQ for scope and field requirements;
- Fold "actively exploited?" into vuln management. That decision is what trips the reporting duty.
Sources
- European Commission Cyber Resilience Act: Reporting obligations
- ENISA The CRA Single Reporting Platform is launched
- Digital Watch Observatory CRA reporting obligations begin for manufacturers