Cyber Resilience Act: reporting duties start this September
11 September marks the start of reporting obligations. The main product requirements follow in December 2027.
- From 11 September 2026
- Full application: December 2027
The European Commission’s implementation timetable sets 11 September 2026 as the start of reporting obligations under the Cyber Resilience Act. Full application follows on 11 December 2027. These are different milestones for manufacturers of products with digital elements.
Guidance published in July addresses scope, support periods, substantial modifications and reporting. The Commission describes it as non-binding. A company must still establish whether its particular product falls within the regulation.
For dual-use software and connected-device suppliers, our practical priority is ownership: who receives a security report, decides what it means and coordinates the response? Leaving that responsibility undefined creates avoidable delays. The timetable alone does not answer product-specific legal questions.
What must be reported, and when
The duty concerns actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. The Commission explains that an early warning is due within 24 hours of awareness, followed by a full notification within 72 hours. This is not a requirement to notify every bug identified during routine software testing.
Final-report deadlines differ. For an actively exploited vulnerability, the Commission gives no later than 14 days after a corrective measure becomes available. For a severe incident, it gives one month after the 72-hour notification. A company’s reporting procedure needs to distinguish these clocks.
One platform and the relevant authorities
Reports use the Single Reporting Platform operated by ENISA. The Commission describes notification to the relevant CSIRT and, as a rule, simultaneous availability to ENISA. ENISA confirms mandatory manufacturer use from 11 September 2026 and publishes instructions for assigned representatives.
For a small manufacturer, a practical priority is establishing responsibility and access before an incident. The organisation needs to know who assesses the event, gathers product-version information and approves a notification. This is our organisational recommendation arising from short deadlines, not an additional statutory form.
Dual-use is not an automatic exemption
Article 2(7) excludes products developed or modified exclusively for national-security or defence purposes and products specifically designed to process classified information. Exclusively matters: selling a civilian product to a military customer does not by itself establish the exemption.
Scope therefore needs to be assessed for a particular product and purpose. Separate legislation also applies to certain medical devices. A single answer should not be assumed across a portfolio merely because the company attends defence exhibitions or describes itself as med-tech.
Reporting now, full application later
Full CRA application begins on 11 December 2027. The Commission’s July guidance addresses scope, substantial modifications, support periods and risk assessment. It is non-binding guidance, not a replacement for the regulation. For open-source software stewards, the Commission identifies a different reporting start: 11 December 2027.
The current stage is therefore more than a future certification project. Manufacturers covered by the September obligations already need a response and notification process. Longer-term planning should connect it to product maintenance, updates and documentation rather than create an isolated administrative workflow.
Sources & context
- European Commission: CRA implementation calendar ↗
- European Commission: reporting obligations ↗
- ENISA: Single Reporting Platform and user guidance ↗
- Regulation (EU) 2024/2847, Articles 2 and 14 ↗
- Commission guidance, 27 July 2026 ↗
Published by Mitchell Strategic Solutions Group. See our editorial standards and corrections policy. Read more →
