From 11 September 2026, the first reporting obligations under the EU Cyber Resilience Act become applicable. For manufacturers of products with digital elements, this means being ready not only to identify reportable vulnerabilities and incidents, but also to act within strict deadlines.
11 September 2026 marks an important milestone in the implementation of the Cyber Resilience Act (CRA). It does not mean that the entire CRA becomes applicable at once. The essential cybersecurity requirements for products will apply from 11 December 2027.
What changes now is the reporting obligation. From 11 September, manufacturers must report certain actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.
And with the first deadline approaching, one practical question is becoming increasingly important: How do manufacturers actually make a CRA report?
What must manufacturers report?
The CRA reporting obligation focuses on two main situations.
Actively exploited vulnerabilities
An actively exploited vulnerability is one for which there is reliable evidence that a malicious actor has exploited the vulnerability without the permission of the system owner.
During its CRA reporting webinar on 27 August 2026, the Dutch The National Cyber Security Centre NCSC clarified that findings from internal research or penetration testing, as well as vulnerabilities reported through responsible disclosure or bug bounty programmes, do not require mandatory reporting where there is no evidence of exploitation. Such cases may, however, be reported voluntarily.
Severe incidents affecting product security
Manufacturers must also report severe incidents that affect the security of a product with digital elements.
This includes incidents that negatively affect, or could negatively affect, the product's ability to protect the availability, authenticity, integrity or confidentiality of important data or functions.
24 hours, 72 hours, final report
The reporting process follows a clear timeline, starting from the moment the manufacturer becomes aware of the actively exploited vulnerability or severe incident.
Within 24 hours: an early warning must be submitted. At this stage, manufacturers are not expected to know everything about the case.
Within 72 hours: a more detailed notification follows, including the information available about the nature and impact of the vulnerability or incident and the measures being taken.
A final report must then complete the reporting process in accordance with the applicable CRA deadlines.
This makes internal escalation critical. If several hours are lost simply determining who is responsible for assessing the situation, a significant part of the reporting window may already have disappeared.
How do manufacturers actually report?
At European level, notifications can be submitted through the Single Reporting Platform (SRP) operated by ENISA. The SRP is the central reporting mechanism created for the CRA and is now available at the ENISA CRA Single Reporting Platform.
What about national reporting channels? The Netherlands example
During a CRA reporting webinar held by the Dutch Ministry of Economic Affairs and the National Cyber Security Centre (NCSC) on 27 August 2026, the authorities explained that manufacturers can report through three channels:
- MijnNCSC, the NCSC's secure cybersecurity portal;
- the reporting form on NCSC.nl; or
- ENISA's Single Reporting Platform.
Manufacturers in other EU Member States should check the arrangements provided by their relevant national CSIRT, as national reporting options may differ.
What should manufacturers do now?
The 24-hour deadline leaves little room to design a reporting process once an incident is already underway.
Before a reportable situation occurs, manufacturers should make sure they:
- know who is responsible for assessing potential CRA notifications;
- define internal thresholds for actively exploited vulnerabilities and severe incidents;
- establish a clear escalation and decision-making path;
- prepare the information and templates required for the different reporting stages;
- understand how vulnerabilities affecting third-party components will be escalated by suppliers; and
- know which reporting channel and CSIRT they will use.
The Dutch NCSC also recommends maintaining visibility into the components contained in products, for example through a Software Bill of Materials (SBOM), and aligning CRA processes with other applicable reporting obligations.
CRA reporting obligations are now a reality
The 11 September deadline turns one part of CRA readiness into an immediate operational requirement.
Manufacturers need to know not only what must be reported, but who makes that decision, how quickly it must happen and where the notification must be submitted.
Clear ownership, defined escalation paths and an established reporting process can make the difference between a controlled response and a race against the 24-hour deadline.
At Brightsight, we support manufacturers in understanding and preparing for the cybersecurity and conformity requirements introduced by the Cyber Resilience Act.
Preparing for CRA compliance?
Enjoyed this article?
Stay up to date with developments in IoT security certification, including PSA Certified, SESIP, and evolving global cybersecurity requirements. Subscribe to our newsletter to receive the latest insights, updates, and announcements from Brightsight.
