The Cyber Resilience Act says its reporting obligations on actively exploited vulnerabilities and severe incidents apply from 11 September 2026. Manufacturers notify through a single reporting platform that reaches both the designated national CSIRT and ENISA. That makes September 2026 the month a software supplier selling into the EU could be inside three reporting regimes at once: CRA, NIS2 and, through its customers, DORA.
The three work differently, and the mistake to avoid is treating them as one clock.
What's affected
The key question for a supplier is who the law binds directly. A rule can bind your customer and reach you only through a contract, or bind you in your own right.
| Regime | Who it binds directly | How a supplier is reached | Core clocks |
|---|---|---|---|
| DORA, Regulation (EU) 2022/2554 | Financial entities | Contracts. Article 30(2)(f) expects the provider to assist when an ICT incident relates to the service, at no additional cost or a cost determined in advance (recital 71) | Delegated Regulation 2025/301 Art. 5(1): initial notification within 4 hours of classifying the incident as major and no later than 24 hours from awareness; intermediate report within 72 hours of the initial one; final report within one month |
| NIS2, Directive (EU) 2022/2555 | Essential and important entities, through national law | Article 21(2)(d) and 21(3) make supplier security a required measure, so contracts and questionnaires | Art. 23(4): early warning within 24 hours of awareness; notification within 72 hours; final report within one month of the notification |
| NIS2 Implementing Regulation (EU) 2024/2690 | Specific providers directly: DNS, TLD registries, cloud, data centre, CDN, managed and managed security services, marketplaces, search engines, social networks, trust services | Direct, if you are in those categories | Defines significant incidents, for example direct financial loss above EUR 500 000 or 5% of annual turnover, whichever is lower; cloud services completely unavailable for more than 30 minutes (Art. 7) |
| CRA, Regulation (EU) 2024/2847 | Manufacturers of products with digital elements | Direct, from 11 September 2026, through the single reporting platform | 24 hour early warning for actively exploited vulnerabilities (recital 120) |
GDPR Article 33 also applies if personal data is involved: processors must notify controllers without undue delay.
Binding versus guidance
Binding: the regulations and directives above, the national laws that transpose NIS2, and your signed contracts, which can be stricter than either.
Guidance: templates, technical advice and good-practice documents from ENISA, supervisors and national CSIRTs. They explain how to meet a duty, but they do not create new ones. Check the status line of any document before you cite it to a customer as a requirement.
Not law yet: the Digital Omnibus proposal, COM(2025) 837, would route reports from several regimes through one ENISA-run entry point and move the GDPR deadline to 96 hours. As of early October 2026 it was a proposal under negotiation, so today's clocks apply.
How to check if you're exposed
Make a table of your ten largest EU customers and ask four things about each.
- Are they a financial entity? If so, DORA flows down to you by contract.
- Are they an essential or important entity under their national NIS2 law?
- Do you fall into one of the provider categories in Regulation 2024/2690 yourself?
- Do you ship a product with digital elements that the CRA covers?
Then read each contract for notice clauses: hours, channel, content and cooperation duties.
What to do now
- Pick a customer notice time you can keep. A financial customer that must file within 24 hours of becoming aware cannot wait days for your report, so many will ask for notice well inside a day.
- Define when your clock starts: when you become aware, not when you finish triage. Record that time.
- Prepare one incident fact sheet that fits the early warning, notification and final report stages: what happened, services and customers affected, indicators, mitigations, root cause, and open questions.
- Name a 24/7 contact on your side and collect theirs.
- Map each product to the CRA question: is it a product with digital elements, and who files for you?
- Add a support clause to your own standard terms: you will help customers meet their reporting duties and share the facts they need.
- Rehearse once with a tabletop where the customer is a bank and the clock is 24 hours.
How to avoid this trap
The trap is answering every customer with "we follow the regulations" and no concrete timing.
- Publish a short security contact page and a notice commitment in hours.
- Keep an incident record format that already matches the three stages: early, intermediate, final.
- Separate vulnerability reports from incident reports, because CRA and your customers treat them differently.
- Do not copy guidance language into contracts as if it were law, and do not skip contract terms because guidance is silent.
Why it matters
Binding duties land on whoever the law names, but the facts come from you. A supplier that cannot tell its customers within hours what happened makes the customer miss its own deadline, and that shows up in the next renewal.
The distinction between binding and guidance also keeps you from overbuilding. Meet the law and your contracts first, then adopt guidance where it saves effort.
Try it yourself
Pick one EU customer and write, in five lines, the clocks that apply to them and to you, with the start event for each. Then check whether your support contract matches.
Click through it at your own pace, or open it full screen.
Quick check
Does DORA bind a software supplier directly to file incident reports?
DORA's incident reporting duty binds financial entities. A supplier is reached through the contract, including the Article 30 duty to assist when an ICT incident relates to the service.
What are the NIS2 Article 23 stages?
An early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification.
Is the Digital Omnibus single entry point in force?
No. It is a proposal, COM(2025) 837. Until it is adopted and applies, current deadlines remain.
Sources
- Regulation (EU) 2024/2847, Cyber Resilience Act, EUR-Lex
- Regulation (EU) 2022/2554, DORA, EUR-Lex
- Delegated Regulation (EU) 2025/301, EUR-Lex
- Directive (EU) 2022/2555, NIS2, EUR-Lex
- NIS2 Article 23 text
- Implementing Regulation (EU) 2024/2690, EUR-Lex
- Kontorbund note on the Digital Omnibus, October 2026
