started · updated
EU Cyber Resilience Act mandates 24-hour security reporting
The European Union’s Cyber Resilience Act (CRA) has entered a critical phase, with mandatory reporting requirements for actively exploited vulnerabilities and severe security incidents taking effect on September 11, 2026. This regulation applies to manufacturers of all products with digital elements sold within the EU, including hardware, software, IoT devices, and crypto wallets.
Under the new rules, manufacturers must adhere to a strict notification timeline: an early warning must be issued within 24 hours of discovery, followed by a detailed notification within 72 hours. Final reports are required within 14 days for exploited vulnerabilities once a fix is available, or within one month for severe security incidents.
Reports must be submitted through the EU’s centralized Cyber Resilience Act Single Reporting Platform (CRA-SRP), managed by the European Union Agency for Cybersecurity (ENISA). Non-compliance carries significant financial risks, with potential administrative penalties reaching up to €15 million or 2.5% of a company’s total worldwide annual turnover.
Additionally, the EU Data Act introduces requirements for connected products, mandating that manufacturers design devices to ensure users have easy, secure, and free access to the data they generate, including metadata. These provisions aim to enhance consumer rights and strengthen the overall cybersecurity posture of the digital single market.
Entities
BSI · Bitkom · Cyber Resilience Act · ENISA · European Commission · European Union · European Union Agency for Cybersecurity · NIS2 Directive · NXP · PwC
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] Half of the surveyed companies lack a dedicated external interface for security reporting. www.silicon.de
- [○ 1 SOURCE] Only 3 percent of surveyed German industrial companies consider themselves fully compliant with the CRA. www.silicon.de
- [● 11 SOURCES] Manufacturers must provide an early warning within 24 hours of becoming aware of an issue. techformator.pl · borncity.com · bezprawnik.pl · zeitenvogel.de · www.techgear.gr · +6 more
- [● 4 SOURCES] The EU Cyber Resilience Act (CRA) entered into force on December 10, 2024. techformator.pl · borncity.com · www.silicon.de · www.cryptobreaking.com
- [● 11 SOURCES] A detailed report must be submitted within 72 hours of the initial notification. techformator.pl · borncity.com · bezprawnik.pl · zeitenvogel.de · www.techgear.gr · +6 more
- [● 12 SOURCES] Reporting obligations for actively exploited vulnerabilities and serious security incidents became active on September 11, 2026. techformator.pl · borncity.com · www.silicon.de · bezprawnik.pl · zeitenvogel.de · +7 more
- [● 7 SOURCES] For severe security incidents, a final report must be submitted within one month of the 72-hour notification. blockchainreporter.net · www.casadomo.com · www.enterprisesecuritytech.com · borncity.com · cryptoslate.com · +2 more
- [● 7 SOURCES] For exploited vulnerabilities, a final report is due within 14 days of a corrective or mitigating measure becoming available. blockchainreporter.net · www.casadomo.com · www.enterprisesecuritytech.com · borncity.com · cryptoslate.com · +2 more
- [○ 1 SOURCE] Non-compliance with the CRA can lead to administrative penalties of up to €15 million or 2.5% of worldwide annual turnover. www.cryptobreaking.com
- [● 3 SOURCES] The CRA applies to manufacturers of products with digital elements, including hardware and software crypto wallets. blockchainreporter.net · www.cryptobreaking.com · cryptoslate.com