The EU Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements sold in the EU. It entered into force on 10 December 2024. Manufacturers had to start reporting actively exploited vulnerabilities on 11 September 2026, and the main obligations apply from 11 December 2027.
What are the dates?
The European Commission's CRA page states them directly:
- 10 December 2024: the Act entered into force.
- 11 September 2026: reporting obligations apply. Manufacturers must report actively exploited vulnerabilities and severe incidents that affect the security of their products.
- 11 December 2027: the main obligations apply. Under Article 71(2), open-source software stewards also become subject to their reporting obligations from this date.
The same page notes that on 27 July 2026 the Commission published practical guidance for manufacturers, developers and businesses of all sizes. Check it for the current reading of scope questions.
What is a product with digital elements?
In plain terms, hardware or software that can connect, directly or indirectly, to a device or network, including its remote data processing parts. That covers a smart doorbell, a router, a mobile app and a library sold as a component. Read the definition in the regulation text on EUR-Lex for your own case, since exclusions exist for products already covered by some sector rules.
What must manufacturers report, and how fast?
The Commission's reporting page describes three steps for an actively exploited vulnerability or severe incident:
- An early warning within 24 hours of becoming aware.
- A full notification within 72 hours.
- A final report. For an exploited vulnerability, this is due no later than 14 days after a corrective measure is available. For a severe incident, it is due within a month of the 72-hour notification.
The practical consequence is internal. A team that cannot answer "are we affected?" within hours cannot meet a 24-hour early warning. That needs an inventory of what is in each product, which is why teams are asking about software bills of materials and about how to tell whether a vulnerable component is actually used.
What else does the Act ask of manufacturers?
The regulation text covers security by design, handling vulnerabilities throughout a support period, and documentation. Because the details are lengthy and the Commission has issued guidance, use the Commission's summary and the legal text as the source, not a secondary retelling. Whether a given product needs a third-party conformity assessment depends on its category, which should be checked against the Act's annexes.
Where can a team start?
Begin with what is feasible this quarter. You already need a way to notice an exploited vulnerability in your products and tell the right people within a day.
Safeguard's SBOM and dependency scanning, plus reachability analysis, can help a team keep a current component inventory and see which findings are reachable. That supports preparation. It does not make a product compliant, because the obligations rest on the manufacturer's processes and documents.
A constructed example: a company ships a gateway appliance with firmware built from forty open source components. A new exploited vulnerability appears in one. Because the company keeps a component list per release, it identifies the three affected releases in an hour and has the facts for an early warning inside the 24-hour window.
How to check or apply this
- List every product you place on the EU market and decide whether it falls in scope.
- Assign one owner for CRA reporting and a backup.
- Keep a current component inventory per release.
- Write a runbook for the 24 hour, 72 hour and final report steps, and rehearse it.
- Check the Commission guidance of 27 July 2026 against your scope assumptions.
- Plan evidence and documentation work for the December 2027 date.
Quick check
Does the CRA apply to open source?
It depends on whether the software is supplied in the course of a commercial activity. The Commission says open-source software stewards have reporting obligations from 11 December 2027. Check the text and guidance for your case.
Is the 24 hour clock from discovery?
The Commission page says from becoming aware of the actively exploited vulnerability or severe incident.
Sources
- European Commission, Cyber Resilience Act
- European Commission, CRA reporting obligations
- Regulation (EU) 2024/2847 on EUR-Lex
Last reviewed: 18 October 2026.
