Cybersecurity and Data
Cyber Resilience and CRA: a guide to reporting vulnerabilities and serious incidents (Part II)
Effective September 11, 2026, Section 14 of the Cyber Resilience Act (CRA) requires manufacturers of products containing digital components to report actively exploited vulnerabilities and serious incidents that affect the security of their products.
Article 14 serves as an initial test of companies’ response capabilities. Preparation begins before a vulnerability or incident arises: it requires knowing which products are affected, assigning responsibilities, and having a procedure in place that can be activated within a very short timeframe.
The first alert must be issued within 24 hours. This timeframe leaves little room to decide who should take action, what information is needed, and how it should be communicated.
Table of Contents
Before you begin: checklist for tech companies
Based on the requirements of Article 14 and the information published by the European Commission and ENISA, this guide proposes, as an operational recommendation, that the company define the following elements before a reportable incident occurs:
- An up-to-date inventory of products, versions, components, and the markets in which they have been sold.
- Internal criteria for distinguishing between an actively exploited vulnerability and a potentially exploitable vulnerability.
- Criteria for determining when an incident affecting product security should be considered serious.
- An escalation process that connects the development, product, cybersecurity, management, legal, and communications teams.
- Authorized personnel responsible for submitting and updating notifications on the ENISA platform.
- Procedures for documenting the time the incident was first detected, the available evidence, the impact assessment, and the decisions made.
- Mechanisms for developing and distributing mitigation measures or security updates.
- A procedure for notifying affected users.
- Information flows with third-party suppliers and component developers to quickly assess how a vulnerability might affect the company’s own product.
- In the case of international groups, clear coordination between the manufacturer, its establishments in the European Union, the authorized representative, and importers and distributors.
The goal is to ensure that technical information can be quickly translated into a coordinated decision, response, and communication.
Five-step guide to Article 14 reporting
Step 1. Determine whether the situation should be reported
The CRA limits the reporting requirement to two scenarios:
- Actively exploited vulnerabilities.
- Serious incidents that affect product security.
Actively exploited vulnerabilities
An actively exploited vulnerability is one for which there is reliable evidence that a malicious actor has used it on a system without the owner’s authorization. The obligation to report arises when there is reliable evidence of actual malicious use and the manufacturer is aware of it.
To assess this situation, the company must ask itself:
- Is the vulnerability present in one of its products?
- Is there reliable evidence that it has been exploited by a malicious actor?
- Did the exploitation occur without the system owner’s authorization?
- When did the manufacturer become aware of this situation?
Serious incidents affecting product security
According to the CRA, a serious incident is one that negatively affects, or could negatively affect, the product’s ability to protect the availability, authenticity, integrity, or confidentiality of sensitive or important data or functions. It is also considered serious if it has caused, or could cause, the introduction or execution of malicious code in the product or in a user’s systems and networks.
An example would be the injection of malicious code into the channel used by a manufacturer to distribute security updates. The company must assess both the impact that has already occurred and the potential impact the incident may cause.
Step 2. Record when the matter came to light and initiate the procedure
The timeframes begin when the manufacturer becomes aware of the actively exploited vulnerability or the serious incident.
Determining and documenting that moment is essential. The company should retain evidence that establishes when it received the first alert, what information was available, and what decisions were made thereafter.
The initial information may come from the company’s own monitoring systems, a security researcher, a vendor, a customer, or a regulatory authority. Regardless of the source, there must be an internal process in place to quickly relay the initial information to the individuals responsible for assessing it.
At this initial stage, it is not necessary to have completed the entire technical analysis. It is, however, necessary to activate the responsible team, preserve the available evidence, and begin to determine the scope and potential consequences.
Step 3. Meet the 24 and 72 hour deadlines
The CRA requires that notifications be made in stages. Notifications must be made without undue delay and, in any case, within the following maximum time limits:
| Phase | Actively Exploited Vulnerability | Serious Incident |
|---|---|---|
| Early Warning | Within 24 hours of the manufacturer becoming aware | Within 24 hours of the manufacturer becoming aware |
| Notification of the vulnerability or incident | Within 72 hours of the manufacturer becoming aware | Within 72 hours of the manufacturer becoming aware |
| Final report | No later than 14 days after a corrective or mitigating measure becomes available | Within one month of the 72-hour notification |
Responsive table: scroll horizontally to see all content.
The purpose of the initial 24-hour alert is to report the incident within that timeframe while the company continues to investigate, assess the impact, and prepare response measures.
The 72-hour notification allows for the initial information to be expanded upon with available data regarding the vulnerability or incident, its severity, its potential consequences, and the measures taken or planned.
The final report completes the process once the company has a more accurate understanding of what occurred and the response that was implemented.
Paso 4. Presentar la notificación mediante la plataforma de ENISA
Communications are carried out through the CRA’s Single Reporting Platform (SRP), which has been operational since September 11, 2026, and is managed by the European Union Agency for Cybersecurity (ENISA).
The manufacturer submits a single notification addressed to the relevant computer security incident response team (CSIRT).
Generally, this will be the CSIRT of the Member State where the manufacturer’s principal place of business in the European Union is located. For these purposes, the principal place of business is considered to be the location where decisions related to the cybersecurity of its products are predominantly made.
The company must decide in advance who is authorized to submit the initial alert, complete the notification, and update it as new information becomes available. Addressing this issue after the deadline has already begun can lead to avoidable delays.
Step 5. Notify the affected users
The obligation does not end with notification to the authorities. When a manufacturer becomes aware of a vulnerability that is being actively exploited or of a serious incident, it must notify the affected users and, where appropriate, all users of the product.
This notification must include, where necessary, corrective or mitigating measures that users can take to reduce the impact. The information must be clear, understandable, and useful to those who use the product.
