What are the CRA obligations since September 11, 2026?

Updated: 12 September, 2026

25 August, 2026

In a nutshell:

Since September 11, 2026, the Cyber Resilience Act (CRA) introduced reporting obligations under Article 14.

Manufacturers are required to report the following to ENISA and their national authority via the ENISA Single Reporting Platform:

• Actively exploited vulnerabilities (where bad actors are actively exploiting a flaw).
• Severe incidents (where the product’s security cannot be maintained).

The reporting timelines are as follows:

• Early Warning Notification: Within 24 hours of becoming aware.
• General Vulnerability Notification: Within 72 hours.
• Final Report: Within 14 days after a corrective or mitigating measure is available.

These obligations apply to all products already on the market, not just new ones.

How to report to ENISA?

The European Union Agency for Cybersecurity (ENISA) Single Reporting Platform (SRP) serves as the centralized EU entry point under the Cyber Resilience Act (CRA) for reporting actively exploited vulnerabilities and severe incidents. Manufacturers and open-source software stewards placing products with digital elements on the EU market must submit notifications through this unified portal.

1: Account Setup & Platform Registration

• EU Login Authentication: Access the SRP portal using an enterprise EU Login account.
• Assign Platform Roles: Set up a Primary Assigned Representative (AR) and invite a Secondary AR as a backup (invitation links expire after 7 days).
• Select Designated CSIRT: Choose your CSIRT Designated as Coordinator (CDaC) from the platform directory based on your organization’s EU Member State of main establishment.
• Organization Profile: Complete manufacturer entity details, address, and legal contacts. CSIRT identity validation occurs in parallel with reporting and will not block initial submissions.

2: Step-by-Step Reporting Procedure

• Initiate Case Lifecycle: Select Submit New Notification on the SRP Dashboard to generate a single case record.
• Submit Early Warning: Complete mandatory initial fields. Click Submit to route data simultaneously to ENISA and your designated CSIRT. (Note: Unsubmitted drafts do not meet statutory deadlines).
• Update Existing Record: Reopen the exact same case record from your Dashboard to complete the 72-Hour Notification and Final Report tabs—do not create separate records for updates.
• Finalize Submission: Complete and submit the Final Report tab. Once submitted, the case becomes read-only.

3: Operational Guidelines

• Single Submission Principle: Filing once on the SRP fulfills legal reporting duties across all EU Member States where the product is distributed.
• Actively Exploited Threshold: Only report vulnerabilities backed by factual evidence of active exploitation in the wild, not theoretical vulnerabilities or unexploited POCs.

What to report to ENISA

What to report to ENISA: The early warning notification:

An Early Warning Notification is the initial mandatory alert required within 24 hours of becoming aware of an actively exploited vulnerability or severe incident impacting a product with digital elements. It serves as an immediate operational alert to European cybersecurity authorities rather than a detailed technical report.

Legal Trigger & Awareness

• Clock Initiation: The 24-hour clock starts the precise moment your security or engineering team confirms credible evidence of active exploitation in the wild (or a severe incident), not when the bug was first discovered or when a patch is prepared.
• Applicability Scope: Applies to all products with digital elements available on the EU market, including legacy software and hardware actively distributed or supported.

Mandatory Data Fields

To prevent reporting delays, the initial 24-hour dataset strictly focuses on baseline administrative and alert data:

• Notification Type & Severity: Declaration of whether the filing is an Actively Exploited Vulnerability (AEV) or a Severe Incident (INC), along with an initial risk level.
• Entity Identification: Manufacturer/steward legal name and registered platform representative contact details.
• Product Identification: Affected product title, model, or software version.
• Malicious Intent Flag: For severe incidents, an indication of whether the event is suspected to be the result of unlawful or malicious acts.
• Geographic Distribution: List of EU Member States where the impacted product has been made available.

Platform Routing & Operational Mechanics

• Dual Dispatch: Clicking submit on the ENISA Single Reporting Platform (SRP) automatically delivers the alert simultaneously to ENISA and your designated CSIRT Coordinator (CDaC) based on your EU main establishment.
• Draft Caveat: Platform drafts are private to the logged-in representative; saving a draft does not count as submitting, and unsubmitted drafts fail legal compliance once the 24-hour mark passes.

What Is Excluded at 24 Hours

• No Technical Root Cause: You are not required to provide technical vulnerability details, exploit mechanics, or threat actor attribution.
• No Mandatory Patch: Remediation, mitigations, and user security advisories do not need to be finalized; substantive details are reserved for the mandatory 72-Hour Update and Final Report stages.

What to report to ENISA: The Vulnerability Notification

The Vulnerability Notification (often referred to as the 72-Hour Notification) is the second mandatory submission stage under Article 14(2)(b) of the Cyber Resilience Act (CRA). Submitted through the ENISA Single Reporting Platform (SRP) within 72 hours of becoming aware of an actively exploited vulnerability, it expands upon the initial 24-hour Early Warning by providing substantive technical, assessment, and mitigation details.

Purpose & Legal Trigger

• Statutory Clock: The 72-hour window runs concurrently with the 24-hour Early Warning clock, starting from initial awareness of active exploitation.
• Objective: Gives CSIRT Coordinators (CDaCs) and ENISA sufficient technical context to evaluate wider ecosystem risks and coordinate cross-border disclosures.

Mandatory Dataset Requirements

SRP Submission Process

• Case Record Re-entry: Access the SRP Dashboard and select the existing case record initiated during the Early Warning stage—do not create a separate submission.
• Complete the 72-Hour Tab: Navigate to the 72-Hour Notification tab within the case record and populate all required fields.
• Submit for Dissemination: Clicking Submit immediately routes the update to ENISA and your designated CSIRT Coordinator. The receiving CSIRT will disseminate the information across member-state CSIRTs unless explicit sensitivity restrictions apply.

Parallel Obligation to Users

Submitting the 72-Hour Notification on the SRP does not fulfill direct customer warning duties. Under CRA Article 14(8), manufacturers must also inform affected product users without undue delay about the vulnerability and actionable user-side mitigations.

What to report to ENISA: The Final Report

The Final Report is the conclusive submission stage under Article 14 of the Cyber Resilience Act (CRA), providing EU cybersecurity authorities with a post-remediation analysis once a vulnerability or incident is fully addressed. It closes out the open case file previously initiated on the ENISA Single Reporting Platform (SRP).

Legal Deadlines & Triggers

Mandatory Dataset Requirements

• Root-Cause Analysis: A complete technical breakdown detailing the underlying vulnerability mechanics (including CVE/CWE identifiers, affected code components, or attack vectors).
• Remediation Details: Software version numbers containing the security fix, patch release dates, links to user-facing security advisories, and deployment instructions.
• Impact Metrics: Confirmed extent of real-world exploitation, operational disruptions, or data compromises observed across the user base.
• Preventative Measures: Internal engineering changes, architectural modifications, or procedural controls implemented to prevent similar occurrences.

Platform Operations & Case Closure

• Reopen Original Record: Access the SRP Dashboard and select the existing case file containing your Early Warning and 72-Hour filings—do not create a new notification.
• Complete the Final Report Tab: Populate the required post-incident telemetry and documentation, then select Submit.
• Read-Only Lock: Submitting the Final Report completes the mandatory reporting lifecycle and freezes the case file into a permanent, read-only state.
• Authority Review: Data is routed simultaneously to ENISA and your designated CSIRT Coordinator (CDaC) for market surveillance verification and aggregate threat intelligence analysis.

Make the process easier with good tools.

SAMMY is a product risk and compliance management tool specialized in CRA. Find out more about CRA compliance tools here.