The news
Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report security problems under the Cyber Resilience Act (CRA). The group covers software, apps and connected devices. According to the European Commission, two kinds of events must be reported: vulnerabilities that attackers are actively exploiting, and severe incidents that affect the security of a product.
The deadlines are short. An early warning is due within 24 hours of the manufacturer becoming aware of the problem, and a fuller notification within 72 hours. A final report follows no later than 14 days after a fix or workaround is available for a vulnerability, or within one month for a severe incident. Manufacturers must also inform the users affected.
Reports go through the Single Reporting Platform, which ENISA, the EU cybersecurity agency, opened on 11 September. A manufacturer reports once, to the national computer security incident response team (CSIRT) of the country where it has its main establishment, and ENISA receives the report at the same time.
The law firm Hogan Lovells Cadwalader notes that the duty also covers products placed on the EU market before the rest of the law applies. The CRA's main security requirements apply from 11 December 2027, the same date reporting starts for open-source software stewards.
What it means for you
- If you sell an app, software or a connected device in the EU under your own name, you need a way to spot an attack on it and report it within 24 hours.
- Products you already sell are covered, not only new ones.
- Someone in your team should know how to file a report on ENISA's platform before an incident happens.
- Wider security rules for these products follow on 11 December 2027, so reporting is the first part of a larger change.
What to do now
- List the software and devices you sell in the EU and who is responsible for each one.
- Name a person who watches for security problems and can file a report within 24 hours, weekends included.
- Read ENISA's guidance on the Single Reporting Platform and walk through a practice case with your team.
- Prepare a short message for telling users about a problem and how to fix it.
How Didset can help
We can add security logging and alerts to the apps and systems we build, so your team learns about an attack in time to report it.
Talk to us about it
