EU Cyber Resilience Act mandates vulnerability reporting from September 2026

Under the European Union's Cyber Resilience Act (CRA), manufacturers of products with digital elements must begin reporting actively exploited vulnerabilities and serious security incidents starting September 11, 2026.

Reports must be submitted to the European Union Agency for Cybersecurity (ENISA) via a single reporting platform. National Computer Security Incident Response Teams (CSIRTs), such as Germany's BSI, will coordinate responses at the national level. ENISA is also mandated to maintain an EU Vulnerability Database to help manufacturers cross-reference their software bills of materials (SBOM).

Companies developing or distributing digital products in the EU market are advised to review their vulnerability assessment, incident response, and internal reporting processes to meet these upcoming requirements. Other CRA obligations, including technical documentation and security by design, are scheduled to become effective on December 11, 2027.