EU’s New Cybersecurity Reporting Rules Are Now in Force and Companies Are Struggling to Keep Up
Brussels’ long-awaited cybersecurity reporting regime for connected products officially kicked in on 11 September 2026, marking one of the more consequential compliance dates in the EU’s push to clean up the digital supply chain. Under the Cyber Resilience Act (CRA), manufacturers selling “products with digital elements” in the EU everything from smart home devices to industrial software must now tell authorities when a vulnerability in their product is being actively exploited, or when a severe security incident occurs, and they have to do it fast.
The change has been on the calendar since the CRA entered into force back in December 2024, but for many companies, the arrival of an actual, working deadline seems to have concentrated minds in a way the original announcement didn’t. Law firms and compliance consultancies spent the days leading up to 11 September publishing last-minute readiness guides, and more than a few manufacturers were still setting up accounts on the reporting platform the week it went live.
One Platform, One Front Door
That platform is the CRA Single Reporting Platform, built and run by ENISA, the EU’s cybersecurity agency, at portal.cra-srp.enisa.europa.eu. Rather than forcing manufacturers to notify a patchwork of national authorities separately, the SRP is meant to work as one front door: a company logs in with an EU Login account (multi-factor authentication required), designates a primary representative who can also appoint up to twenty secondary users, and files its notification to the CSIRT the national computer security incident response team in the country where it has its main EU establishment. That CSIRT then passes the information along to its counterparts in whichever other member states the product is sold in, unless there’s a specific security reason to hold off.
What Actually Triggers a Filing
What actually triggers a filing comes down to two categories. The first is an actively exploited vulnerability not just a flaw that’s been discovered, but one where there’s credible evidence someone has already used it against a system without permission. The second is a “severe incident,” broadly meaning anything that meaningfully undermines a product’s availability, integrity, authenticity or confidentiality, including cases involving malicious code. Routine bugs and vulnerabilities that get caught and patched before anyone exploits them don’t fall under this obligation — the CRA is targeting live, real-world risk.
The Clock Starts Ticking
The clock that starts once a manufacturer becomes aware of either situation is unforgiving. An early warning is due within 24 hours, offering little more than an initial heads-up. A fuller notification, with an actual assessment of severity and impact, follows within 72 hours. From there, the process concludes with a final report: 14 days after a fix becomes available, in the case of an exploited vulnerability, or within a month of the initial notification for a severe incident. Companies that have spent the past two years thinking about the CRA mostly in terms of design and documentation requirements are now discovering that the reporting obligation is really a test of internal speed — whether a company can detect a problem, decide it meets the threshold, and get the paperwork moving inside a single business day.
Not the Whole Law – Yet
It’s worth being clear about what did and didn’t happen this month. This is not the full Cyber Resilience Act landing all at once. The regulation’s broader requirements secure by design engineering, CE marking, software bills of materials, minimum support periods of five years come fully into force in December 2027, alongside conformity assessment routes that get stricter as products move up the CRA’s risk classes, from basic self-assessment to mandatory third-party certification for the most sensitive categories, such as smart meters and secure elements. Open-source software stewards, notably, get more breathing room and won’t face their own version of these reporting duties until December 2027. What arrived on 11 September was narrower but immediate: the incident and vulnerability reporting machinery, running years ahead of the rest of the regulation, apparently on the theory that Brussels would rather have early visibility into what’s going wrong in the field before the heavier design obligations even bite.
The Cost of Getting It Wrong
The incentive to get this right is not subtle. The CRA’s penalty structure runs in tiers, and while the harshest fines up to €15 million or 2.5% of global annual turnover, whichever is greater are reserved for breaches of the core security requirements, the vulnerability-handling and reporting obligations sit in a still-serious second tier, with fines reaching €10 million or 2% of turnover. A separate, somewhat lower tier applies to companies that give regulators incomplete or misleading information. National market surveillance authorities are left to work out the actual number in any given case, weighing factors like how serious the lapse was and how big the company is which means the exposure isn’t uniform, but it isn’t small either.
What Companies Are Doing About It
For the companies actually living with this, the practical advice circulating this month has been fairly consistent: figure out now, not during an actual incident, who inside the organization is authorized to decide something meets the reporting threshold, get the SRP account and representatives set up in advance, and map how CRA notifications interact with the parallel reporting duties already owed under NIS2 and, where personal data is involved, GDPR. Regulators moving in overlapping timeframes with overlapping obligations is nothing new in Brussels, but for security and compliance teams bracing for the next incident, September 11 was the day the theoretical version of that problem became a very real one.
This article was written with the help of A.I
More can be read/downloaded here: enisa.cra.factsheet.pdf
More information here: enisa.europa.eu
And here: Single reporting platform (SRP)