As of today, 11 September 2026, companies that make software or connected devices have to report vulnerabilities that attackers are actively exploiting. The duty comes from the EU’s Cyber Resilience Act (CRA). It applies to small Estonian firms too, if they sell digital products under their own name.
What changed today?
ENISA, the EU’s cybersecurity agency, opened its Single Reporting Platform today. Manufacturers use it to file the reports that Article 14 of the CRA requires. Most of the regulation’s security requirements only apply from 11 December 2027, but the reporting duty is live now.
Two kinds of event must be reported. The first is an actively exploited vulnerability in your product. The second is a severe incident affecting the product’s security, for example one that puts sensitive data at risk or lets someone run malicious code on the product.
A report goes to the national CSIRT designated as coordinator and to ENISA at the same time. You file with the CSIRT of the member state where your main cybersecurity decisions are made. For Estonia, ENISA’s list of coordinators names CERT-EE at the Information System Authority (RIA).
Announcing the platform, ENISA’s Executive Director Juhan Lepassaar said that “vulnerabilities in digital products are often exploited by threat actors to subvert or hamper critical services”, naming healthcare, energy, transport and telecommunications as examples.
What are the deadlines?
Article 14 sets three deadlines for an exploited vulnerability and three for a severe incident. The clock starts when the manufacturer becomes aware of the problem.
| Deadline | What to send |
|---|---|
| Within 24 hours | Early warning, including the member states where the product is sold, if known |
| Within 72 hours | Notification with general information on the product, the problem and the measures taken |
| No later than 14 days after a fix or mitigation is available | Final report on an exploited vulnerability |
| One month after the 72-hour notification | Final report on a severe incident |
The duty also covers products already on the market. Article 69(3) says so explicitly, and the European Commission repeats it. Devices and software versions you sold years ago can therefore trigger a report.
Article 14(8) adds a duty towards customers: where appropriate, the manufacturer must tell affected users about the vulnerability or incident and, where necessary, what they can do to limit the damage.
Micro and small enterprises cannot be fined solely for missing the 24-hour early warning deadline. That does not remove the duty to report, and the other deadlines apply to them in full.
Is your company a “manufacturer”?
Under the CRA, a manufacturer develops or makes a product with digital elements, or has one made. It then markets that product under its own name or trademark. Whether you charge for it or give it away makes no difference, as long as it is part of a commercial activity.
More small companies fit this description than you might expect. Typical examples:
- a software firm selling its own program or mobile app;
- a company that has smart plugs or sensors made abroad and sells them under its own brand;
- a device maker whose product talks to the company’s own app or server.
An accounting firm or a shop that only uses other people’s software is generally not a manufacturer. It is affected indirectly, through its suppliers. The boundary is not always obvious. This article is not legal advice, so if you are unsure, ask a lawyer.
What should you do now?
- Decide whether you are a manufacturer. List every product you market under your own name, including older versions and free apps.
- Name the person who reports. The early warning is due within 24 hours, weekends included. Agree on an owner and a deputy, and look at ENISA’s platform before you need it in earnest.
- Prepare a message for your users. Work out how you will reach customers quickly and what you will tell them about the problem and the workarounds.
- Keep a list of your product’s components. If you know which libraries and parts your product uses, you can quickly tell whether a newly exploited vulnerability affects you. This list is often called a software bill of materials (SBOM).
- Look for weaknesses before attackers do. Fewer exploitable holes mean fewer reports. ENISA points small companies to its SME Cyber Resilience Maturity Assessment Model and its Secure by Design and Default Playbook, and a security check of your website and applications is another way to start.
Sources
- EUR-Lex: Regulation (EU) 2024/2847 (Cyber Resilience Act)
- ENISA: The CRA Single Reporting Platform is launched
- ENISA: List of CSIRTs Designated as Coordinators
- European Commission: Safer and more secure digital products
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
