The Cyber Resilience Act reporting obligation explained

Who has to report?

Manufacturers of products with digital elements that are placed on the market in the EU. The obligation has applied since 11 September 2026 (Article 71(2)), including to products that were already on the market before that date (Article 69(3)). Importers and distributors inform the manufacturer when they become aware of a vulnerability (Articles 19 and 20). The Applicability Check helps you find out whether your product falls under the Regulation at all.

What triggers the reporting obligation?

Two events (Article 14(1) and (3)):

• An actively exploited vulnerability in your product. Not every reported flaw, but one where there are signs that it is already being exploited.
• A severe incident having an impact on the security of the product, for example if your update infrastructure is compromised.

The catch: you only know whether a vulnerability is being actively exploited once someone has read and assessed the report. That is why every report has to be looked at quickly, at night and at weekends too.

When does the clock start?

With awareness. The Regulation requires the early warning "without undue delay and in any event within 24 hours of the manufacturer becoming aware of it" (Article 14(2)(a)). The Regulation does not define awareness; according to the Commission guidance of July 2026, the manufacturer is aware once an initial assessment gives a reasonable degree of certainty that the vulnerability is being actively exploited. This moment should be documented, because all three deadlines are counted from it.

What has to be reported?

1. Early warning, 24 hoursThat a vulnerability is being actively exploited and, where known, in which Member States the product has been made available. Nothing more. The early warning is meant to be fast, not complete.
2. Vulnerability notification, 72 hoursGeneral information about the product, the nature of the vulnerability and of the exploit, corrective or mitigating measures taken and measures that users can take, and, where applicable, how sensitive the information is.
3. Final report, 14 daysOnce a corrective or mitigating measure is available: a description of the vulnerability, including its severity and impact, information about any malicious actor, where available, and details of the security update or other corrective measure itself.

Where is it reported?

Through the ENISA single reporting platform (Article 16). The notification goes to the CSIRT designated as coordinator for the Member State where you have your main establishment (Article 14(7)), in Germany CERT-Bund at the BSI, and is accessible to ENISA at the same time. According to ENISA, the platform is currently a web form with no API; you need a registered account and a person who knows how to use it.

What else is part of it

• Inform users (Article 14(8)): tell impacted users in good time about the vulnerability and about measures they can take.
• Publish a reporting address (Annex I, Part II, point (6), applies from 11 December 2027): a contact address that third parties can use to report vulnerabilities. In Germany, the BSI describes a security.txt file for this in TR-03183-3, which the generator creates for you.
• Evidence: market surveillance authorities can ask you to show that you met the deadlines. Who knew what and when should be recorded.

Penalties for infringements

Article 64(2) provides for administrative fines of up to EUR 15 million or 2.5 per cent of total worldwide annual turnover for infringements of Article 14. Under Article 71(2), the penalty provision only applies from 11 December 2027; until then, the reporting obligation applies without fines attached. The deadlines apply regardless, and it remains up to the manufacturer to show that they were met. More in the guide Fines and market surveillance.