Summary Points
- From September 11, 2026, CRA-covered manufacturers must report actively exploited vulnerabilities within 24 hours, with fuller details due within 72.
- Reporting comes 15 months before core cybersecurity engineering requirements—creating visibility before prevention is mandated.
- The real test isn’t filing on time; it’s knowing what shipped, when a vulnerability was discovered, and who can act on it.
- Treat software provenance as a continuously funded operational capability—not a last-minute compliance project—to prepare for December 2027.
The EU CRA Will Make You Report What It Hasn’t Yet Made You Fix
Visibility comes before prevention
From September 11, 2026, manufacturers selling products with digital elements in the EU must notify regulators within 24 hours when they learn that someone actively exploits a vulnerability. They must provide a fuller account within 72 hours.
The timing matters. The CRA’s core cybersecurity requirements for product design and development do not apply until December 11, 2027. For 15 months, companies must report certain serious problems before those engineering rules take effect.
That gap does not make reporting pointless. Regulators will gain a clearer picture of real-world vulnerabilities than vendor assurances alone can provide. Companies, too, may find that reporting exposes a basic weakness: they cannot quickly identify what went into a product, who learned about a flaw, or when that happened.
A report is a start, not a repair
Many firms can meet the first deadline with templates, assigned contacts, and a short-term compliance effort. That is practical—and necessary. But a timely filing does not show that a company can fix a flaw, trace it across products, or prevent the next one.
The CRA may push more organizations to build those capabilities. Yet adoption will matter most when companies treat product knowledge and vulnerability response as ongoing work, not a rush before a deadline. Boards should ask more than, “Will we file on time?” They should ask whether teams can find reliable answers without launching an emergency project.
The reporting rules begin a broader cybersecurity journey. They create visibility and accountability. The later requirements aim to shape how companies build products. Between those steps, firms have a chance to turn disclosure into better practice—not merely better paperwork.
Expand Your Tech Knowledge
Get real-time Cyber Updates on threats, defenses, and industry shifts.
Explore past and present digital transformations on the Internet Archive.
Expert Insights
