Under the EU Cyber Resilience Act, manufacturers of software and hardware products with digital elements must build security in, handle vulnerabilities through the product's life, keep an SBOM, and report actively exploited vulnerabilities. Reporting applies from 11 September 2026. The main obligations apply from 11 December 2027.
Key takeaways
- The reporting duty is already live as of 19 October 2026: 24 hours for an early warning, 72 hours for a notification.
- The full set of product requirements applies from 11 December 2027.
- Manufacturers must keep an SBOM, run a coordinated vulnerability disclosure policy and ship security updates without delay.
- Security support must last at least five years unless the product's expected use is shorter.
- This is a plain language summary, not legal advice. Confirm scope with counsel.
What are the key dates?
The European Commission's CRA page gives three dates. The Act entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026. The main obligations apply from 11 December 2027. The Commission also published practical implementation guidance on 27 July 2026.
Because the first deadline has passed, a team that has not set up reporting is already behind on that part.
Who has to comply?
Manufacturers carry the main obligations for products with digital elements. The Commission describes these as software and hardware products, with apps and computer programs given as examples. It also notes that manufacturers along the whole supply chain share responsibility for security.
Whether a specific product, service or open source project is in scope depends on the regulation's definitions and roles. Check that with a lawyer instead of guessing.
What must I report, and how fast?
You must report actively exploited vulnerabilities and severe incidents affecting product security. Article 14 sets these clocks, which start when you become aware:
- Early warning: within 24 hours.
- Vulnerability notification: within 72 hours.
- Final report: no later than 14 days after a corrective or mitigating measure is available.
For severe incidents, the early warning is 24 hours, the notification 72 hours, and the final report is due within one month after the incident notification. The Commission says reports go through ENISA's Single Reporting Platform.
The practical consequence is that you need a way to decide quickly whether a vulnerability is being exploited. Our guide on responding to a critical CVE in a week covers that triage.
What does the Act require for vulnerability handling?
Annex I, Part II lists the duties. In plain terms, you must:
- Identify and document vulnerabilities and components, including an SBOM in a commonly used, machine-readable format that covers at least top level dependencies.
- Fix vulnerabilities without delay, and ship security updates separately from feature updates where technically feasible.
- Test product security regularly.
- Publicly disclose fixed vulnerabilities once an update is available, with limited room to delay in justified cases.
- Run and enforce a coordinated vulnerability disclosure policy.
- Provide a contact address for vulnerability reports.
- Provide secure update distribution.
- Distribute security updates without delay and free of charge, with advisory messages for users, unless otherwise agreed for tailor-made products.
Do I have to check my open source dependencies?
Yes, in the sense of due diligence. Article 13 says manufacturers shall exercise due diligence when integrating components sourced from third parties. The related recital says to check, for example, whether a component receives regular security updates and whether it has known vulnerabilities in public databases.
That is an inventory and monitoring task. See how to create an SBOM step by step for the first half.
How long must I support the product?
At least five years, unless the product is expected to be used for less time, in which case the support period matches the expected use. You must state the end date, at least month and year, at the time of purchase. Under Article 13, a security update must also remain available for a minimum of 10 years after it is issued, or for the rest of the support period if that is longer.
A starting checklist for software companies
- Decide which of your products have digital elements and who is the manufacturer
- Name an owner for the 24 hour and 72 hour reporting clocks
- Keep a current SBOM per release
- Publish a vulnerability reporting address and disclosure policy
- Record your support end date for each product
- Monitor your components against known vulnerability data, including CISA KEV status
The Gold registry shows CVEs with CISA KEV status, and you can check a dependency file for free at gold.safeguard.sh/scan. Neither makes you compliant. They help with the inventory and monitoring parts.
Frequently asked questions
When does the Cyber Resilience Act apply?
Reporting obligations apply from 11 September 2026 and the main obligations from 11 December 2027. The Act entered into force on 10 December 2024.
Does the CRA require an SBOM?
Yes. Annex I requires manufacturers to draw up an SBOM in a commonly used and machine-readable format covering at least top level dependencies. It must be given to a market surveillance authority on a reasoned request.
What is the 24 hour rule?
When you become aware of an actively exploited vulnerability in your product, you must submit an early warning within 24 hours. A fuller notification follows within 72 hours.
Who enforces the CRA?
According to the Commission, national market surveillance authorities enforce the rules. Some products may also need third party assessment before sale in the EU.
Does the CRA apply to companies outside the EU?
The Act covers products placed on the EU market. If you sell into the EU, assume it concerns you and ask counsel to confirm your role.
Sources
- European Commission: Cyber Resilience Act
- Regulation (EU) 2024/2847 on EUR-Lex
- CISA Known Exploited Vulnerabilities catalog
Last reviewed: 19 October 2026.
