EU Cyber Resilience Act Reporting Duties Began 11 September 2026, Ahead of Most Rules

The EU Cyber Resilience Act sets cybersecurity rules for products that connect to a device or network. The Commission says the regulation aims to safeguard consumers and businesses, and it addresses weak cybersecurity in many products and the lack of timely security updates. Its reporting duties started on 11 September 2026, while most other obligations wait until 11 December 2027, according to the European Commission. The regulation entered into force on 10 December 2024.

The reporting duty also reaches products already on the EU market.

What Manufacturers Must Report

The duty covers two kinds of event. The first is an actively exploited vulnerability, meaning a security weakness for which there is reliable evidence that a malicious actor has exploited it. Squire Patton Boggs gives the example of confirmed exploitation of an authentication flaw to gain unauthorised access.

The second is a severe incident, meaning an incident that affects a product’s security. Squire Patton Boggs gives the example of an incident that compromises the confidentiality or integrity of sensitive data. Severity depends on the impact on sensitive or important data or functions, or on the execution of malicious code, according to the same article.

Manufacturers must also inform impacted users without undue delay and, where appropriate, all users. The notice must cover any measures users can take to mitigate or correct the risk where necessary.

Squire Patton Boggs says the general product compliance requirements do not yet apply to the products concerned, but the reporting obligations do.

Key Dates
The European Commission says reporting obligations under the Cyber Resilience Act apply from 11 September 2026, while the main obligations apply from 11 December 2027. The regulation entered into force on 10 December 2024.

The Reporting Clock

The first step is an early warning, due within 24 hours of the manufacturer becoming aware of the problem, and without undue delay. A detailed notification follows within 72 hours. Depending on the event, it must include the affected product, the nature, severity and impact of the problem, and any corrective or mitigating measures taken or available.

The clock runs from awareness, not from the platform going live, according to the independent guide. The Commission gives the final report deadline for actively exploited vulnerabilities as no later than 14 days after a corrective measure is available. Squire Patton Boggs describes that limit as generally applying, and refers to a corrective or mitigating measure.

For severe incidents, the final report is due within one month after the 72-hour notification. The independent guide advises manufacturers to set up internal detection and triage that can recognise both kinds of event, and to complete registration and a dry run before a real incident.

One Platform and How Reports Are Routed

ENISA set up the Single Reporting Platform under Article 16 of the regulation, working with the CSIRT Network. It develops, operates and maintains the platform, according to ENISA, and manufacturers and open-source stewards submit notifications through it. Manufacturers report only once.

The platform went live on 11 September 2026, according to the independent guide. ENISA’s press release says it has deployed the initial operating capability, and ENISA’s platform page records an upgrade to version 1.3 on 4 November 2026. The independent guide adds that voluntary reporting under Article 15, a reporting API and a field for the date a manufacturer became aware of a vulnerability did not launch with the platform.

Squire Patton Boggs says a submitter needs an EU Login account, which should be set up in advance, and must register as an assigned representative for the manufacturer. Registration can be completed with the first notification, and CSIRT validation is not required before submitting. ENISA’s platform page describes primary and secondary assigned representative roles.

The Commission says notifications go to the CSIRT in the country where the manufacturer has its main establishment. Squire Patton Boggs says the manufacturer selects the competent CSIRT, which is generally the one in that country. ENISA receives the same information at the same time, unless exceptional circumstances apply. That CSIRT then shares the notification without delay with the CSIRTs in every territory where the product is available.

In exceptional circumstances, on justified cybersecurity grounds, a CSIRT may delay that sharing. A delegated act adopted on 11 December 2025 sets the terms and conditions for applying those grounds.

Which Products Fall in Scope

The regulation covers software and hardware products with digital elements. The independent guide defines the term by intended or reasonably foreseeable use. A product is covered when that use includes a direct or indirect data connection. The guide lists connected consumer devices, business hardware, apps, operating systems, libraries and components as covered unless an exclusion applies.

Remote data-processing solutions count as part of the product where the product needs them to perform its functions. The independent guide also says manufacturers outside the EU are covered if they sell into the Union, and must ensure an economic operator in the EU is responsible for the relevant obligations.

The Commission’s examples include baby monitors, smart watches, apps and computer programs. Squire Patton Boggs also lists software applications, IoT products, routers, connected machinery, smartphones, laptops, smart home products, connected toys, and open-source software supplied in a commercial activity. It names accounting and finance software too.

Some products are excluded because sector-specific rules already apply. The independent guide names medical devices, motor vehicles and civil aviation. Non-commercial open-source software developed outside a commercial activity is largely out of scope, and open-source stewards have a lighter, tailored set of obligations.

These windows start from awareness, not from the platform going live.

How Products Are Classified and Assessed

The independent guide sorts products into conformity categories. The default category covers most products with digital elements, and these use self-assessment. Products that comply bear the CE marking, and national market surveillance authorities enforce the rules, according to the Commission.

Important Class I products, such as password managers and VPNs, need harmonised standards or third-party assessment. Important Class II products, such as operating systems and firewalls, need third-party assessment. Critical products, such as smart meters and smart cards, need mandatory certification.

Classification follows the product’s core functionality, and where more than one class could apply, the stricter one applies. Manufacturers must keep technical documentation for ten years after the product is placed on the market, and must draw up an EU declaration of conformity, according to the independent guide.

The Commission says products of particular cybersecurity relevance may need a third-party assessment by a notified body before they can be sold on the EU market.

Fines and the Dates Still Ahead

The independent guide gives the top fine tier as up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher. It applies to breaches of essential requirements or manufacturer obligations. Other infringements, and supplying incorrect information, carry lower ceilings.

The independent guide lists 11 June 2026 as the date Chapter IV applies, which covers the notification of conformity-assessment bodies. The main obligations apply from 11 December 2027, and reporting obligations for open-source software stewards under Article 24(3) start on the same date, according to the Commission.

The Commission published practical guidance for manufacturers, developers and businesses of all sizes on 27 July 2026, to help them meet their CRA obligations. Under the main obligations, manufacturers must meet mandatory cybersecurity requirements for planning, design, development and maintenance, at every stage of the value chain, according to the Commission.