Compliance · Cyber Resilience Act

CRA reporting is live. Is your process?

Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents within 24 hours, through ENISA's Single Reporting Platform. The rest of the Cyber Resilience Act applies from 11 December 2027. We build the vulnerability handling process that makes both possible.

The reporting clock

24 hours after becoming aware of an actively exploited vulnerability: early warning
72 hours: vulnerability notification with the nature of the exploit and the measures taken
14 days after a fix or mitigation is available: final report
Severe incidents affecting product security follow 24 hours, 72 hours and one month

Our free incident reporting clock calculates these deadlines next to NIS2, DORA and GDPR.

What we set up

Vulnerability handling process (PSIRT)Intake, triage, severity scoring, fix and release, with named roles and the reporting decision built into triage, so the 24-hour clock is a step in the process and not a surprise.

Coordinated disclosure policyA published policy and a security.txt contact, as required for vulnerability reporting under the CRA, with response times you can keep and a safe-harbour statement for researchers.

SBOM in the buildSoftware bills of materials in CycloneDX or SPDX generated by your CI pipeline for every release, and dependency monitoring against KEV and EPSS so exploited components surface the same day.

Reporting readinessReport templates for the early warning, notification and final report, a tested path to ENISA's Single Reporting Platform, and a short exercise with your product and support teams.

Scope check: the CRA covers hardware and software products with digital elements placed on the EU market, with exclusions for products under their own sector rules (for example medical devices and vehicles) and for pure SaaS covered by NIS2. If you are unsure whether you are a manufacturer, importer or distributor under the CRA, that is the first thing we work out together.

Shipping software or devices into the EU?

Tell us what you build and how you release it today. We'll reply with what is missing for CRA reporting and a fixed price to close it.

Get in touch →