normakte / CRA reporting obligation
The CRA reporting obligation has applied since 11 September 2026. Two reporting paths, four deadlines, and a duty towards users that runs separately.
New: reports go through ENISA's CRA platform →
The CRA for all products with digital elements: overview →
What has occurred?
Not reportable are vulnerabilities found in good faith, without malicious intent, for testing, investigation, remediation or disclosure purposes (recital 68). Voluntary reporting is provided for by Art. 15 – check on ENISA's website whether the platform already accepts them.
The Commission specifies the reporting obligations through delegated acts, and the list of CSIRTs designated as coordinators is kept up to date. We write to you if something changes.
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents: early warning within 24 hours, notification within 72 hours, then a final report.
The manufacturer – also for products placed on the market before 11 December 2027. The obligation therefore already covers products that are on the market today.
Via ENISA's CRA Single Reporting Platform: the manufacturer selects the coordinating CSIRT of the Member State of its main establishment in the Union, and ENISA receives the notification at the same time.
No. Actively exploited vulnerabilities must be reported. Other vulnerabilities are remedied as part of vulnerability handling; Art. 15 provides for voluntary reporting.
Register, classification, SBOM, reports with deadlines and a target page for users – one trial file free until 20.01.2027.