Loading story…
The EU Cyber Resilience Act (CRA) has entered its operational reporting-obligation phase, requiring covered manufacturers of products with digital elements to report actively exploited vulnerabilities and severe security incidents. Manufacturers must issue an early warning within 24 hours, submit a notification including a preliminary assessment within 72 hours, and provide final follow-up reports according to timelines that depend on the event type.
ENISA launched the Single Reporting Platform (SRP) alongside the new obligations, providing a single channel that routes reports to ENISA and the relevant national CSIRT. The CRA entered into force in December 2024 and is due for full application in December 2027; implementation work still includes a planned fourth-quarter delegated act on whether the EU Common Criteria cybersecurity-certification scheme creates a presumption of CRA conformity.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
A delegated act was issued describing exceptional circumstances in which a national CSIRT may delay wider sharing of a CRA report, including when disclosure could enable exploitation or interfere with near-complete mitigation.
The EU Cyber Resilience Act (CRA) entered into force, establishing cybersecurity requirements for products with digital elements.
CRA-covered manufacturers became required to report actively exploited vulnerabilities and severe incidents, including a 24-hour early warning and 72-hour notification. ENISA publicly launched the Single Reporting Platform, which routes a single manufacturer report to ENISA and the relevant national CSIRT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, has begun its vulnerability-reporting phase: manufacturers of hardware and software products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents to ENISA and relevant national CSIRTs. The staged reporting obligations, including an initial report within 24 hours, apply to products already on the market as well as new offerings. The CRA took effect in December 2024, with conformity-assessment body notifications beginning in June 2026; full enforcement and mandatory CE marking are scheduled for December 2027. Organizations subject to the regulation need established processes to rapidly classify incidents, verify production impact, coordinate legal, security, and product stakeholders, and make defensible disclosures amid overlapping requirements under GDPR, NIS2, DORA, SEC rules, and anticipated CIRCIA obligations.
Sep 23, 2026
The European Union’s **Cyber Resilience Act (CRA)** is entering its first operational phase, with manufacturers of products with digital elements facing a key compliance deadline on **11 September 2026**. From that date, vendors selling software and connected hardware in the EU must report **actively exploited vulnerabilities** and **severe security incidents** through an **ENISA-operated Single Reporting Platform**, including an early warning within 24 hours of becoming aware of an issue and a fuller notification within 72 hours. The reporting duty is limited to cases with reliable evidence of active exploitation or incidents that seriously affect product security, rather than every discovered flaw. The CRA is the EU’s product-security framework for software and connectable hardware, designed to address weak default security, poor vulnerability handling, and inconsistent delivery of security updates across a product’s lifecycle. It requires manufacturers to build cybersecurity into planning, design, development, and maintenance, with some higher-risk products subject to third-party conformity assessment before sale in the EU and compliance signaled through **CE marking**. The European Commission has also issued implementation guidance clarifying scope, substantial modifications, support periods, and risk-assessment expectations, ahead of the broader CRA obligations taking effect in December 2027.
Aug 13, 2026
EU manufacturers of products with digital elements must begin meeting **Cyber Resilience Act (CRA) Article 14** reporting obligations on 11 September 2026, before the regulation becomes broadly applicable in December 2027. They must report reliably evidenced active exploitation of vulnerabilities affecting their products, as well as severe security incidents involving those products. The process requires an early notification within 24 hours, a more detailed notification within 72 hours, and a final report within one month of the initial notice. Requirements extend to legacy products already on the EU market and to exploited vulnerabilities in third-party software or hardware components that affect a manufacturer’s product; organizations need current product and component inventories, defined escalation paths, and coordinated vulnerability-management, incident-response, and regulatory-reporting procedures.
Sep 15, 2026