EU Cyber Resilience Act: vulnerability reporting is now mandatory

The reporting obligations of the EU Cyber Resilience Act (CRA) apply since 11 September 2026. Manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe incidents affecting the security of their products. ENISA opened its Single Reporting Platform the same day.

The platform lets a manufacturer report once and reach every authority concerned: the notification goes to the CSIRT designated as coordinator, which passes it to the CSIRTs of the other Member States where the product is sold, while ENISA receives it at the same time. ENISA says the platform's initial operating capability is in place and will be expanded over the coming months. Open-source software stewards follow on 11 December 2027, the date the CRA's main cybersecurity requirements also apply.

ENISA's executive director, Juhan Lepassaar, said: "Vulnerabilities in digital products are often exploited by threat actors to subvert or hamper critical services."

Why it matters For the first time, exploitation of a vulnerability in a product sold in the EU becomes a reportable event for its maker, with a regulator's clock running. Knowing early whether a weakness is being traded or discussed in criminal communities is now a compliance question as well as a security one.