The Cyber Resilience Act: reporting has started
CRA manufacturer reporting began on 11 September 2026. The main product requirements follow in December 2027. Check product scope and your role now.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
Since 11 September 2026, manufacturers within the Cyber Resilience Act’s scope must report actively exploited vulnerabilities and severe incidents affecting the security of their products. The main product requirements apply from 11 December 2027.
For a Norwegian company supplying the EU market, product security belongs on the release and support plan now. Norwegian incorporation is a separate question from obligations arising when products are made available in the EU.
Determine whether the product is covered
The CRA covers defined hardware and software products with digital elements made available on the EU market. It is broader than connected devices, but it does not simply cover anything containing software.
Assess the intended or reasonably foreseeable data connection, relevant exclusions and any remote data-processing solution needed for a product function. Open-source software also has specific rules. The Commission’s scope summary explains these distinctions.
Identify whether your business is the manufacturer, importer or distributor. Each role carries different responsibilities. Record the product classification and applicable conformity-assessment route rather than assuming self-assessment is always sufficient.
Prepare the reporting path
Manufacturers must submit an early warning within 24 hours of awareness and a fuller notification within 72 hours. For an actively exploited vulnerability, the final report is due within 14 days after a corrective measure becomes available; for a severe incident, within one month of the 72-hour notification. Reports use the single reporting platform. The Commission provides the instructions.
This is not a requirement to report every scanner finding as an actively exploited vulnerability. Classification needs a documented assessment, with someone able to decide and submit it out of hours.
Open-source software stewards have a different reporting start date under their specific provisions; do not apply the manufacturer’s timetable indiscriminately.
Connect development and support
Before the main requirements apply, establish the product risk assessment, vulnerability-handling process, component records, support commitments and technical documentation needed for the relevant conformity route.
Plan who receives vulnerability reports, assesses exploitation, delivers fixes and communicates security information. A release process without a support process leaves part of the product lifecycle unmanaged.
An ISO 27001 management system can support governance and records. It does not replace the CRA’s product-specific assessment or market obligations.
