CRA reporting obligations: what applies since 11 September 2026

Since 11 September 2026, the reporting obligations of Article 14 of the Cyber Resilience Act apply. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents.

The three deadlines

1. Early warning within 24 hours of becoming aware
2. Notification within 72 hours with first details and measures
3. Final report no later than 14 days after a corrective measure is available (for incidents: one month after the notification)

What “awareness” means

The clock starts as soon as your company learns about the exploitation – not when the security team opens the ticket. That's why Secvisory records the moment of awareness separately and requires a reason for every change.

Our advice

Define responsibilities now. Who reports? Who approves? Who informs customers? A CRA case in Secvisory answers these questions before things are on fire.