Cyber Resilience Act
CRA obligations, made manageable
Handle, disclose, report vulnerabilities: Secvisory provides the processes and evidence the CRA requires from manufacturers.
Timeline
The key dates
The reporting obligations apply since September 2026. From December 2027 the CRA applies in full – including CE marking.
10 Dec 2024
CRA enters into force
Regulation (EU) 2024/2847.
11 Jun 2026
Conformity assessment bodies
Notification of conformity assessment bodies.
11 Sep 2026
Reporting obligations
24h / 72h / final report for actively exploited vulnerabilities and severe incidents.
11 Dec 2027
Full application
All essential requirements from Annex I.
Art. 14
Reporting deadlines that monitor themselves
A CRA case starts at the moment of awareness. Secvisory calculates all deadlines, reminds you in time and prepares notification drafts.
24h early warning, 72h notification, final report
Email reminders
Export for the reporting platform
app.secvisory.com/cra/cases/CRA-2026-007
CRA-2026-007 · Actively exploited
Awareness: 08 Oct 2026, 06:14
Early warning in
17:42:09
24h
Early warning
72h
Notification
14d
Final report
Case created, time recorded
Early warning draft prepared
Approval by CISO
Annex I, Part II
Systematic vulnerability handling
CVD policy, vulnerability intake, SBOM, disclosure of fixed vulnerabilities and distribution of update information – all in one place.
CVD policy following ISO/IEC 29147
Encrypted vulnerability intake
SBOMs in CycloneDX & SPDX
FAQ
Questions about the CRA
Which CRA deadlines does Secvisory support?
For actively exploited vulnerabilities and severe incidents under Art. 14: early warning within 24 hours, notification within 72 hours and a final report. Deadlines start at the moment of awareness, reminders are sent automatically.
Is Secvisory legal advice?
No. Secvisory provides the tools and processes the CRA requires. For the legal assessment of your products we recommend your legal counsel or notified body.
