From 11 September 2026, manufacturers of products with digital elements sold into the EU market – including those operating through German entities such as a GmbH – are required to report actively exploited vulnerabilities and severe incidents to ENISA and relevant CSIRTs within 24 hours of becoming aware of them. This obligation arises under the Cyber Resilience Act (Regulation (EU) 2024/2847) and represents the first wave of binding requirements under that regulation, preceding the full product conformity obligations which apply from 11 December 2027. International companies with German operations or that place products on the German market should assess their exposure now, before the September 2026 deadline.
What Changed and When
The Cyber Resilience Act entered into force as Regulation (EU) 2024/2847. Its requirements are phased, with the earliest and most immediately pressing obligations being those related to vulnerability disclosure and incident reporting. As of 11 September 2026, manufacturers must:
- Submit an early warning to ENISA and the relevant national CSIRT within 24 hours of becoming aware of an actively exploited vulnerability in their product;
- Report severe incidents having an impact on the security of their products within the same 24-hour window;
- Follow up those initial notifications with more detailed reports within the timelines established under the regulation.
The broader set of product requirements – covering secure-by-design obligations, conformity assessments, CE marking and market surveillance – does not become binding until 11 December 2027. However, building compliant processes takes time, and the reporting framework that activates in September 2026 assumes that internal monitoring and escalation procedures are already in place.
Germany has not yet enacted specific national implementing legislation supplementing the CRA's reporting framework; where national procedural rules remain pending, companies should monitor the position of the Bundesamt für Sicherheit in der Informationstechnik (BSI), which is the designated national authority for cybersecurity product oversight in Germany, for further guidance.
Who Is Affected in Germany
The regulation applies to manufacturers – the legal or natural persons who develop or manufacture products with digital elements and place them on the EU market under their own name or trademark. This broad definition captures:
- Hardware and software product companies with a German GmbH or other registered entity that manufactures or imports digital products;
- Non-EU manufacturers that have an authorised representative in Germany or that sell directly into the German market;
- Companies offering products that contain software as an integral component, even where software is not the primary commercial offering;
- Open-source software developers in commercial contexts – the regulation includes specific, but limited, carve-outs for non-commercial open-source projects, and the boundaries of those carve-outs require careful analysis.
Importers and distributors carry their own, lesser obligations under the CRA, but manufacturers bear the primary reporting burden. German subsidiaries of multinational groups should verify whether the group's global vulnerability management programme satisfies the regulation's requirements, or whether a Germany-specific or EU-specific process is needed.
It is also worth noting that products in scope may overlap with requirements under other EU instruments. Where a product incorporates general-purpose AI components or qualifies as a high-risk AI system under the AI Act, obligations may run in parallel – including requirements around algorithmic transparency and registration with the AI Office. Our AI law practice in Germany advises on the intersection of these regulatory frameworks.
If your company needs to review its current exposure under both the Cyber Resilience Act and related EU digital regulations, our team is available to assist. Write to us at info@ferrazwhitmore.com or visit our contacts page.
Key Deadlines at a Glance
| Date | Obligation | Who |
|---|---|---|
| 11 September 2026 | Early warning to ENISA / national CSIRT within 24 hours of awareness of actively exploited vulnerability or severe incident | Manufacturers |
| 11 December 2027 | Full product requirements: secure-by-design, conformity assessment, CE marking, market surveillance cooperation | Manufacturers, importers, distributors |
| Ongoing / pending | National procedural rules from BSI and other German authorities supplementing the CRA framework | All economic operators in Germany |
Immediate Actions for International Companies
With the September 2026 reporting deadline approaching, international companies active in Germany should prioritise the following:
- Scope your product portfolio. Determine which products qualify as "products with digital elements" under the CRA and whether any fall within the higher-risk categories subject to third-party conformity assessment.
- Audit your vulnerability management process. The 24-hour early warning requirement is operationally demanding. Assess whether your current internal security monitoring, triage and escalation procedures can meet that window, and identify gaps.
- Designate a responsible contact for ENISA and BSI notifications. Establish who within your organisation (or your EU authorised representative) will own the reporting obligation and ensure they have the authority and information access to act swiftly.
- Review your German corporate structure. Where reporting obligations or enforcement action may flow through a German GmbH or branch, confirm that local management is aware of the obligations and that the entity's registration in the Handelsregister accurately reflects its role in the product supply chain.
- Begin preparation for December 2027 product requirements now. Retrofitting secure-by-design principles and conformity assessment processes is significantly more costly than building them in from the outset. Use the period before the full obligations apply to conduct a gap analysis and implement a compliance roadmap.
For a detailed analysis of the CRA's reporting obligations and how they interact with other EU cybersecurity and product liability rules, see our CRA vulnerability reporting alert for the EU.
Enforcement Considerations in Germany
Germany's enforcement landscape for product regulation is well-developed. The BSI has a mandate to act as market surveillance authority for cybersecurity requirements, and it has historically been active in issuing guidance and, where necessary, enforcement measures. Non-compliance with the CRA's reporting obligations once they apply could result in administrative penalties under the regulation's enforcement framework; the applicable penalty thresholds are set out in the CRA itself and will be enforced in Germany through the designated national authority.
Companies should also be aware that product liability exposure under German civil law may be affected by CRA compliance status. While the Bundesgerichtshof has not yet ruled on cases arising directly under the CRA – given that the reporting obligations do not apply until 2026 – judicial interpretation of what constitutes adequate security for a digital product is evolving, and compliance with the CRA's framework will increasingly be relevant to assessing reasonable care in both civil and regulatory proceedings.
Employment-related considerations should not be overlooked either: companies may need to update internal compliance roles, appoint or train data and cybersecurity officers, and reflect new obligations in internal policies. Our employment law team in Germany can advise on any workforce implications arising from these structural changes.
How Ferraz & Whitmore Can Help
Our Germany practice works with manufacturers, technology companies and international investors to assess regulatory exposure across the EU's evolving digital and cybersecurity framework. We provide gap analyses, advise on entity structure, assist with communications to authorities including the BSI, and help build the internal governance frameworks that CRA compliance requires.
We do not offer generic templates or guaranteed outcomes. What we offer is precise analysis of how these obligations apply to your specific products, corporate structure and market presence in Germany, and practical steps to address them within the relevant timelines.
To discuss how the Cyber Resilience Act's reporting obligations affect your organisation in Germany, contact our team at info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.