Cyber Resilience Act: Reporting Deadlines and Compliance Guidance
Summary
The article explains the CRA’s mandatory reporting deadlines, who must report exploited vulnerabilities or severe incidents, how the Single Reporting Platform works, and upcoming standards ahead of full compliance in 2027.
Key points
- The article says that, as of September 11, companies must report actively exploited vulnerabilities and severe incidents to EU authorities within 24 hours of becoming aware of them.
- A notification with threat and mitigation information is due within 72 hours; the final report for an exploited vulnerability is due within 14 days of a fix, while severe-incident reporting has a one-month deadline after the 72-hour notification.
- The article says companies do not have to report every vulnerability—only vulnerabilities known to be actively exploited with malicious intent or severe incidents affecting product security.
- Companies must also inform affected users about corrective measures they can take to mitigate an incident’s impact.
- Pre-registration with the Single Reporting Platform is not required when there is nothing to report; an Authorised Representative can submit up to 20 notifications while validation is pending.
- Full CRA security requirements apply to products sold in the EU by December 11, 2027. The article highlights draft standards EN 40000-1-1 and EN 40000-1-3 as worth monitoring.
Article Details
- Topic
- Cyber Resilience Act reporting obligations, Single Reporting Platform procedures, and compliance timelines