From 11 September 2026, manufacturers of products with digital elements sold in the European Union are required to report actively exploited vulnerabilities and severe incidents to ENISA and the relevant CSIRT within 24 hours of becoming aware of them – a significant new compliance obligation under the Cyber Resilience Act (Regulation (EU) 2024/2847). Companies that fail to meet these deadlines face regulatory scrutiny at a moment when EU enforcement frameworks, including those touching AI law and algorithmic transparency, are tightening across the board. Understanding which products fall within scope, and acting on that understanding now, is essential for any international manufacturer with a presence in the EU market.
What Changed and When
The Cyber Resilience Act introduces a structured, phased timetable. The first and most immediate milestone is 11 September 2026, from which the vulnerability reporting and incident notification obligations become enforceable. Specifically, manufacturers must issue an early warning to ENISA and the competent national CSIRT within 24 hours of identifying that a vulnerability in their product is being actively exploited, or that a severe incident affecting the security of a product has occurred.
The second major milestone – full product conformity requirements, including security-by-design obligations, essential cybersecurity requirements, and technical documentation – applies from 11 December 2027. Businesses that treat the 2027 date as the only relevant deadline are making a material planning error: the reporting obligations arrive more than a year earlier.
Who Is Affected
The Cyber Resilience Act applies to manufacturers, importers, and distributors of products with digital elements that are placed on or made available in the EU market. This captures a broad range of hardware and software – from consumer devices and industrial systems to embedded software components. The regulation is explicit that economic actors established outside the EU are not exempt if their products reach EU consumers or businesses.
Certain categories are excluded or governed by sector-specific rules (for example, some medical devices and civil aviation products), but international companies should not assume exclusion without a formal scope assessment. High-risk AI systems as defined under the AI Act may also overlap with CRA scope where those systems are embedded in products with digital elements; the interaction between the two frameworks is an area where legal analysis is particularly important. The AI Office and European Commission have signalled that enforcement coordination across both instruments is intended.
The 24-Hour Reporting Obligation in Detail
From 11 September 2026, the reporting chain operates as follows:
- Early warning (24 hours): Upon becoming aware of an actively exploited vulnerability or severe incident, the manufacturer must notify ENISA and the relevant national CSIRT without undue delay and no later than 24 hours. This notification need not be complete but must confirm awareness and provide initial details.
- Incident notification (72 hours): A more detailed notification to ENISA and the CSIRT is due within 72 hours, covering the nature of the vulnerability or incident, initial impact assessment, and any mitigation measures already taken.
- Final report: A comprehensive final report, including root-cause analysis and a description of corrective actions, must be submitted within a timeframe set out in the regulation. The precise national procedural rules for submission are subject to implementation by each Member State's competent authority.
The reporting chain involves both ENISA at EU level and national CSIRTs. Manufacturers with operations in multiple Member States should map which national authority is their primary point of contact, as this depends on the location of the manufacturer's EU establishment. For a practical step-by-step breakdown of the 24-hour reporting process, see our CRA 24-hour reporting guide for the EU.
Thresholds and Severity Criteria
Not every security defect triggers the 24-hour reporting clock. The obligation is activated by two conditions, either of which is sufficient:
- A vulnerability in the product is actively exploited – that is, there is evidence that a threat actor is using it in the wild, regardless of whether harm has yet materialised.
- An incident has occurred that has or could have a severe impact on the security of the product and, by extension, on its users or interconnected systems.
The regulation does not set a purely numerical threshold (such as a number of affected users) as the sole criterion. Manufacturers must therefore maintain internal severity classification frameworks that are calibrated to the regulatory definition, not only to their own commercial risk appetite. Where a product incorporates general-purpose AI or is connected to systems subject to algorithmic transparency obligations under the AI Act, the severity assessment may need to account for AI-specific failure modes.
Immediate Action Items for International Companies
Given that 11 September 2026 is the first hard deadline, the preparation window is limited. The following steps represent the baseline of what manufacturers should be addressing now:
- Scope determination: Conduct a formal assessment of which products in your portfolio constitute "products with digital elements" under Regulation (EU) 2024/2847 and confirm whether any sector-specific exemptions apply.
- CSIRT mapping: Identify the competent national CSIRT(s) and ENISA notification channels relevant to your EU establishment or, where you have no EU establishment, the Member States in which your products are primarily sold.
- Internal incident classification: Develop or revise internal security incident response procedures to include a specific classification layer for CRA-triggering events, with clear ownership and escalation paths that can meet a 24-hour clock.
- Cross-regulatory alignment: Review how CRA obligations interact with existing obligations under NIS2, GDPR incident reporting, and – where relevant – AI Act requirements for high-risk AI systems, to avoid fragmented responses to a single event.
- Governance and record-keeping: Ensure that technical documentation and vulnerability management logs are structured to support both the immediate notification and the subsequent detailed report, including root-cause analysis. Regulators including ESMA and EBA have signalled increased scrutiny of digital product governance across the financial sector; comparable expectations are emerging in the CRA context.
If your organisation has not yet completed a CRA readiness review, the time to begin is now, not in the months immediately before September 2026. Early gaps are far easier to remediate than gaps identified under the pressure of an actual incident.
Ferraz & Whitmore advises international manufacturers, technology companies, and investors on regulatory compliance across the EU. If you would like to discuss your organisation's position under the Cyber Resilience Act, please write to us at info@ferrazwhitmore.com or visit our contacts page.
Looking Ahead: December 2027 and Beyond
While the immediate focus must be on the September 2026 reporting obligations, the December 2027 deadline for full product conformity requirements is equally consequential. From that date, manufacturers must demonstrate that products with digital elements satisfy the essential cybersecurity requirements of the CRA throughout their expected product lifecycle – including security-by-design principles, regular security updates, and the absence of known exploitable vulnerabilities at the point of placing the product on the market.
Preparatory work for 2027 – conformity assessments, technical documentation, authorised representative arrangements for non-EU manufacturers, and supply chain due diligence – intersects with compliance programmes already under way for the AI Act, where the European Commission and the AI Office are advancing implementation guidance on high-risk AI systems and general-purpose AI models. Companies that coordinate their CRA and AI Act programmes will be better positioned than those treating each as a separate workstream. EUR-Lex remains the authoritative source for the consolidated text of both instruments as amendments are adopted.
To discuss how the Cyber Resilience Act applies to your specific product lines or to understand the interplay with your broader EU regulatory obligations, contact our team at info@ferrazwhitmore.com or use the form on our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.