Cyber Resilience Act: what software manufacturers have to do since the reporting obligation began

What has applied since 11 September 2026

The Cyber Resilience Act (Regulation (EU) 2024/2847) has been in force since December 2024. Since 11 September 2026, the first part that directly affects manufacturers has applied: the reporting obligations under Article 14. Manufacturers must report actively exploited vulnerabilities and severe security incidents that affect their products.

Important: the reporting obligation also applies to products that were placed on the market before this date. The remaining obligations, such as security by design, security updates throughout the support period, conformity assessment and CE marking, follow on 11 December 2027.

Who is affected

The CRA applies to products with digital elements that are offered in the EU: software and hardware that can connect to a device or network. This includes desktop and mobile apps, installable business software, firmware and connected devices.

• Manufacturers bear the main obligations, even if they are based outside the EU.
• Importers and distributors must check whether the manufacturer meets its obligations.
• Pure SaaS services do not fall under the CRA. Whether NIS2 applies to you depends on sector and company size. The CRA is different where the cloud is part of a product’s function, for example the backend of an app or a device.
• Open source without commercial activity is exempt. A lighter regime applies to organisations that support open source on a lasting basis.

If in doubt, a short legal assessment is worthwhile. Anyone who distributes installable software, apps or connected devices is, as a rule, affected.

The reporting chain: 24 hours, 72 hours, 14 days

As soon as you learn of an actively exploited vulnerability, the clock starts:

1. Early warning within 24 hours: that the vulnerability exists and in which Member States your product is available.
2. Notification within 72 hours: details on the product, on the nature of the exploitation and on the measures taken or recommended.
3. Final report no later than 14 days after a fix or mitigation is available: severity, impact, root cause and remediation.

For severe security incidents, 24 and 72 hours also apply, and the final report is due one month after the notification. Reports are submitted through ENISA’s single reporting platform, simultaneously to ENISA and to the coordinating CSIRT of the Member State of your main establishment, in Germany the BSI. Where applicable, you must also inform affected users.

Why this is a code topic

24 hours is short. To keep to it, you must be able to answer three questions quickly:

• Which components are in which version of your product? Without a current bill of materials (SBOM), you will not know at the next Log4j-type vulnerability whether you are affected.
• Where in the code is the problem? If you know your code, you can assess severity and impact instead of guessing.
• How quickly can you ship? A fix only helps once it reaches the users.

Often it is not an exotic zero-day but a known vulnerability in a dependency that could have been updated long ago. More and more of these dependencies enter projects through AI assistants; more on this in Vibe coding: how secure is AI-generated code?

Checklist for the next 30 days

1. Clarify whether you are affected: Which products fall under the CRA, and in what role are you?
2. Assign responsibility: Who reports, who deputises, who can be reached at the weekend?
3. Automate the SBOM: Generate a bill of materials in CycloneDX or SPDX format with every release.
4. Scan dependencies continuously: against CVE and OSV databases, with an alert for new matches.
5. Open a reporting channel for third parties: a security.txt and a coordinated disclosure policy.
6. Rehearse a report: Prepare a template for the 24-hour early warning and run through it once.
7. Establish the current state: Where do you stand today? A code audit shows known vulnerabilities, outdated packages and secrets before they are exploited and therefore reportable.

What penalties are possible

For violations of the essential requirements and the obligations under Articles 13 and 14, the CRA provides for fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Withdrawals from the market may follow. Micro and small enterprises are exempt from fines for a late 24-hour early warning, but they must still report.

This article provides context, it does not replace legal advice.

How a code audit helps

Our code audit checks your dependencies against known vulnerabilities, searches for secrets in code and history and assesses the code against the OWASP Top 10:2025. Every finding comes with a CVSS rating and an action plan. The report serves as a documented current state for customers and supervisory authorities. Fixed price €890 net, delivered in 2 working days.

The report does not replace a conformity assessment or CE marking. It does show you where you need to start. Our methodology describes how we proceed.

Are you buying or taking over software? Then the code audit for technical due diligence is the right starting point.