The CRA’s 24-Hour Rule: Preparing for the Cyber Resilience Act’s September 2026 Reporting Obligations

The first major EU Cyber Resilience Act (the CRA) compliance deadline is fast approaching. From 11 September 2026, manufacturers within scope of the CRA must comply with new reporting obligations for actively exploited vulnerabilities and severe incidents. These requirements take effect more than a year before the CRA’s substantive provisions, making them an early priority for organisations preparing for compliance.

For manufacturers, the challenge is not simply understanding the reporting requirements but also to operationalise. The CRA introduces reporting timelines measured in hours rather than days – manufacturers must submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours - requiring organisations to establish governance structures, escalation pathways and technical capabilities capable of determining whether a reportable event has occurred and submitting notifications within tight regulatory deadlines.

 

The CRA Reporting Framework

The CRA seeks to strengthen the cybersecurity of products with digital elements (including both software and hardware products), by imposing cybersecurity conformity requirements and vulnerability management throughout the product lifecycle, from design and development through to placement on the market. A key component of this framework is the introduction of mandatory reporting obligations for actively exploited vulnerabilities and severe incidents.

The CRA establishes two distinct reporting obligations for manufacturers of products with digital elements:

1. Actively exploited vulnerabilities: These are vulnerabilities contained within a manufacturer’s product that are being actively exploited by threat actors. While the vulnerability must exist in the manufacturer’s product, the exploitation may occur in any system or environment in which that product is deployed.
2. Severe incidents: These are incidents that have, or are capable of having, a significant impact on the security of a product with digital elements. This includes incidents that negatively affect or are capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or an incident that has led or is capable of leading to the introduction or execution of malicious code in a product with digital elements or in the network and information systems of a user of the product with digital elements.
3. The definition extends to compromises of a manufacturer’s development, production or maintenance environments, such as the injection of malicious code into a software update channel. Notably, the use of the phrase “capable of” suggests that reporting may be required even where harm has not yet materialised, similar to language within NIS2.

Notifications should be submitted through the CRA’s Single Reporting Platform (SRP), operated by ENISA, and which we anticipate will be launched to coincide with the 11 September notification commencement date. Manufacturers will be expected to submit a single notification through the platform, which then routes the information to ENISA and the relevant national Computer Security Incident Response Team (CSIRT) of the manufacturer. The relevant CSIRT is be identified applying the jurisdictional rules set out in the CRA. Manufacturers should therefore ensure they understand which EU touchpoints may be relevant to their reporting obligations.

 

Understanding the 24-Hour Rule

The CRA’s reporting obligations apply from 11 September 2026 to all products with digital elements that fall within the CRA’s scope, notwithstanding that rest of the CRA’s obligations do not come into force until 11 December 2027. Importantly, these reporting obligations continue to apply even after a product’s support period has ended. As a result, manufacturers may still be required to report actively exploited vulnerabilities and severe incidents affecting older or no longer supported products, provided they are available in the EU market.

Once a manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting the security of its product, an early warning must be submitted within 24 hours. The notification must include preliminary information regarding the vulnerability or incident and indicate whether it may have been caused by malicious or unlawful activity.

The CRA establishes a phased reporting framework:

• Within 24 hours of awareness: Early warning notification.
• Within 72 hours of awareness: A more detailed notification containing an assessment of the event, its severity and impact, and any available mitigation measures.
• Final report: For actively exploited vulnerabilities, a final report must generally be submitted within 14 days after a corrective measure becomes available. For severe incidents, a final report is generally due within one month of the 72-hour notification.

The CRA also requires manufacturers to notify impacted users (and ‘where appropriate’ all users) within ‘a timely manner’. These notifications must set out the available risk mitigation and corrective measures that users can take to reduce the impact of the vulnerability or incident and must be provided in a structured, machine-readable format. Where a manufacturer fails to inform users in a “timely manner”, the notified CSIRT may provide such information to the users when considered proportionate and necessary for preventing or mitigating the impact of that vulnerability/ incident.

 

Key Compliance Challenges

Organisations face several practical hurdles:

• Understanding CRA exposure: Manufacturers should assess in advance whether their products fall within the CRA’s scope, including existing products already on the EU market. This will be an important first step in preparing for the 11 September 2026 reporting deadline.
• Identifying reportable events: Determining whether an issue constitutes an actively exploited vulnerability or a severe incident is the first hurdle. The 24-hour early warning requirement leaves little room for delay, requiring organisations to detect, assess and escalate issues in near real time.
• Aligning incident reporting policies and processes: Organisations in scope of the CRA should review existing incident assessment and response policies to incorporate CRA notification triggers. These will differ from existing reporting obligations, such as under NIS2, DORA, and the GDPR, particularly where the trigger relates to product security rather than operational activities or personal data.
• Defining the “awareness” trigger: Awareness of an incident will depend on the facts and how quickly such facts can be established. Manufacturers should therefore have processes to assess incidents quickly, determine whether CRA reporting thresholds are met and escalate decisions without delay.
• Supply chain visibility: Many products with digital elements depend heavily on third-party software, open-source components and external suppliers. As a result, identifying whether a newly disclosed supply chain vulnerability affects products already placed on the EU market can be challenging, particularly where component dependencies are complex or not fully documented. For example, although the CRA’s reporting obligations fall on manufacturers, they may not be the first to become aware of an issue. Information may instead emerge through importers, distributors, security researchers or downstream component suppliers. This underscores the importance of establishing robust contractual notification and escalation mechanisms throughout the supply chain.

 

Practical Steps for Preparation

Organisations should consider the following actions in the weeks ahead:

• Map product offering: identify all products with digital elements within the CRA’s scope, including legacy products, and assign vulnerability-handling ownership for each.
• Build CRA-ready governance: designate clear ownership and responsibilities for the end-to-end compliance of impacted products with digital elements and review incident response policies to ensure the organisation can meet CRA reporting obligations.
• Build a reporting playbook: document internal escalation triggers; reporting thresholds; decision criteria for “awareness”, template notifications, required information gathering processes; and communication procedures.
• Strengthen supply chain arrangements: assess supplier contracts, initiate uplifts where needed and establish ongoing due diligence and assurance processes. This will include looking both upstream to manufacturers and suppliers of other integrated components, and downstream to importers and distributors.
• Integrate reporting processes across different regulatory regimes: a single event may trigger obligations under the CRA, NIS2, DORA and the GDPR simultaneously, each with different thresholds, timelines and content requirements. Organisations should map these overlaps and, where possible, design unified intake and triage processes that can satisfy multiple regimes from a single workflow.
• Test the process: tabletop exercises should specifically examine CRA reporting scenarios and focus on whether relevant stakeholders can be identified, contacted and brought together quickly enough to meet the 24-hour deadline.

 

Looking Ahead

For many organisations, the CRA’s reporting obligations represent the first real enforcement test of the Act. The challenge is not simply understanding the law — it is ensuring that legal, security and product teams can work together quickly enough to identify reportable events, make defensible decisions and submit notifications within hours.

With the 24-hour reporting obligations taking effect on 11 September 2026, organisations should now be treating CRA reporting readiness as an immediate compliance priority. Those that wait until the first vulnerability or incident occurs may find that the greatest risk is not the cyber event itself, but the inability to respond quickly enough to satisfy the regulator.

We have dedicated experts working on the CRA and other EU Digital Decade laws across DLA Piper. For any further insights on how the CRA may apply to your organisation, visit our CRA page and get in touch with your usual DLA Piper contact.