Cyber Resilience Act: Reporting Obligations Already Apply – Including for Products Already on the Market
Updated: Sep 24
Many companies have 11 December 2027 marked in their calendars. That is the date from which only CRA-compliant products with digital elements may be placed on the market. The date that matters more in practice has already arrived: since 11 September 2026, manufacturers' reporting obligations under Art. 14 of the Cyber Resilience Act (CRA) have applied – across all products, including those that have long been on the market.
What this means in concrete terms:
24 hours for the early warning to the competent CSIRT (in Germany: the Federal Office for Information Security, BSI) and to ENISA – after becoming aware of an actively exploited vulnerability or a severe incident.
72 hours for the follow-up notification with an initial assessment of the impact and remedial measures.
1 month for the final report. In between, the CSIRT may request an interim report.
In addition: information to the affected users under Art. 14(8) CRA.
Three points that are underestimated in practice:
1. The scope is broader than expected. The CRA covers not only IoT devices and networked machinery but also stand-alone software. According to the interpretation of the EU Commission and the BSI, an indirect logical data connection is sufficient – for example via APIs, files or network sockets. Accounting software, apps, even a text editor therefore fall within the scope. Pure SaaS is not covered (it is subject to NIS-2 regulation) – client-server constellations raise delicate questions of delimitation here.
2. The concept of manufacturer is broad. Under Art. 3(13) CRA, a manufacturer also includes anyone who merely has a product manufactured and distributes it under its own brand – or who substantially modifies a product. This differs from the concept of manufacturer under the NIS-2 Directive and the German BSI Act (BSIG).
3. Negative decisions must be documented too. Whether an incident crosses the threshold of a "severe incident" is assessed by the manufacturer itself. The criteria in Art. 14(5) CRA require interpretation ("sensitive or important data", "capable of affecting"). Anyone who concludes that no reporting obligation exists should record that assessment in a traceable manner – for the event of market surveillance.
Action required:
Embed reporting processes in an incident management system, establish escalation paths along the supply chain and align CRA reporting with the existing procedures under the GDPR and the BSIG/NIS-2. With a 24-hour deadline, what counts is not the legal assessment after the fact but the prepared process chain. The CRA thus takes effect even before its general date of application – as a driver for professionalised, product-related incident management.
