From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents — the CRA's first obligation to bite, ahead of the main requirements in December 2027.
What changed
Regulation (EU) 2024/2847 (the Cyber Resilience Act) entered into force on 10 December 2024 and applies in phases: its reporting obligations apply from 11 September 2026, and its main obligations — secure-by-design requirements, vulnerability-handling duties across a product's support period, and CE-marking conformity — from 11 December 2027. From the September 2026 date, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products with digital elements to the authorities designated under the regulation.
Why it matters
The first CRA duty is a detection-and-reporting capability with regulatory deadlines, not a documentation exercise: it requires knowing when a vulnerability in your product is being exploited in the wild and having a tested route to report it. That capability spans security, engineering and legal, and cannot be stood up in the final weeks before 11 September 2026.
Who is affected
Manufacturers of hardware and software with digital elements sold in the EU carry the reporting duty; importers and distributors have supporting obligations under the regulation and a direct interest in their suppliers' readiness.
Rolessecurity teamsincident response teamsproduct leadscompliance teams
Organisationsmanufacturers of hardware and softwareimportersdistributors
What to check next
- Identify which of your products fall within the CRA's 'products with digital elements' scope
- Prepare the internal flow to detect, triage and report actively exploited vulnerabilities and severe incidents from 11 September 2026
- Confirm the exact reporting triggers, recipients and time limits in the regulation text
- Map ownership of the reporting duty across security, engineering and compliance
- Document how vulnerability handling will feed the conformity work due by 11 December 2027
Key dates
- 2024-12-10Entry into force
- 2026-09-11Reporting obligations apply
- 2027-12-11Main obligations apply
Source. EUR-Lex — Regulation (EU) 2024/2847 (Cyber Resilience Act) ↗
Document: Regulation (EU) 2024/2847 — CELEX 32024R2847
Verified by Trusq against this source on 4 Jul 2026. Trusq publishes only what it can trace to an official source; the source text prevails. Not legal advice.
Document: Regulation (EU) 2024/2847 — CELEX 32024R2847
Verified by Trusq against this source on 4 Jul 2026. Trusq publishes only what it can trace to an official source; the source text prevails. Not legal advice.