From 11 September 2026, the vulnerability and severe incident reporting obligations in Article 14 of the EU Cyber Resilience Act (CRA) formally apply.

Once a manufacturer becomes aware of an actively exploited vulnerability (AEV) in a product, or of a severe incident (SI) affecting product security, it must report mandatorily through the EU CRA Single Reporting Platform (SRP).

Three critical deadlines

(1) 24 hours: Early Warning

From the moment it becomes aware of an AEV or severe incident, the manufacturer must submit an Early Warning without undue delay and no later than 24 hours. The key information required is:

· Type of notification: vulnerability or incident;

· Product name and version;

· Title and summary;

· Manufacturer information;

· Member States in which the product is placed on the market;

· Basic known facts about the vulnerability or incident;

· Known impact and risk information.

Purpose: to tell the regulator quickly "what has happened".

(2) 72 hours: full notification

Building on the 24-hour warning, a further notification must be submitted no later than 72 hours. It should cover:

· CVE or EUVD identifier, where applicable;

· Detailed overview of the vulnerability or incident;

· Impact of the vulnerability or incident;

· Severity;

· Attack vector;

· Corrective or mitigating measures already taken;

· Risk mitigation measures available to users;

· Information on malicious actors, where known;

· Information sensitivity and any special circumstances.

Purpose: to move from "we have found a problem" to "what the problem is, how serious it is and what has been done about it".

Note that the current ENISA SRP fields explicitly show that some fields may be optional at the 24-hour stage but become mandatory at the 72-hour or final report stage, so manufacturers should keep supplementing and updating the information.

(3) Final report: closing the loop

The deadline for the final report depends on the type of case:

· AEV (actively exploited vulnerability): within 14 days of a corrective or mitigating measure becoming available.

· Severe incident (SI): within one month of the 72-hour notification.

The final report should complete the picture with:

· A full description of the vulnerability or incident;

· Actual and potential impact;

· Severity;

· Attack method and, where known, the actor behind it;

· Threat type or likely root cause;

· Measures implemented and continuing to be implemented;

· Final corrective measure or security update.

Purpose: to form a complete loop from discovery and assessment through handling to remediation.

An operational point that is easily overlooked: confirm before you submit

The CRA SRP allows the 24-hour, 72-hour and final reports to be stored as drafts. A draft is visible only to you and can be refined before submission.

Saving a draft is not the same as submitting.

Saving a draft:
✔ Can still be edited
✔ Not yet part of the formal notification process
✔ Visible only to you

Clicking Submit:
⚠ The notification enters the formal CRA SRP process and notifications are sent to the relevant authorities.
⚠ Do not treat a formal submission as "saving a draft" — complete internal review and verification of the information first.
⚠ A submitted notification can still be updated before the final report is filed, but this is not a simple "withdraw and resubmit"; once the final report is submitted, the notification can no longer be edited.

A particular reminder: the 24-hour window is very short, but "running out of time" does not justify submitting without review. Manufacturers should put internal triage, approval and escalation procedures in place in advance.

What should manufacturers prepare?

CRA reporting is not simply filling in a form; it is a continuous vulnerability and incident response mechanism:

Vulnerability discovery

↓

AEV / SI assessment

↓

Internal risk evaluation

↓

24 h Early Warning

↓

72 h Notification

↓

Corrective / mitigating measures

↓

Final Report

↓

Evidence retention and ongoing monitoring

We recommend that manufacturers establish in advance:

A PSIRT vulnerability response mechanism; a CVD vulnerability disclosure process; a security incident response process; 24 h / 72 h reporting procedures; a vulnerability severity classification scheme; CVE / EUVD management; a user security notification mechanism; corrective action management; and a CRA SRP reporting workflow.

NTEK Information Security Laboratory

CRA compliance assessment; PSIRT system development; CVD process development; vulnerability management; security incident response; and support for CRA 24 h / 72 h / final reporting.

From vulnerability discovery to the final report, we help manufacturers build full-lifecycle cybersecurity management and a closed reporting loop for CRA-regulated products.

The CRA reporting obligation has applied since 11 September 2026. What manufacturers need is not only the ability to fill in a report, but the ability to identify, assess, decide and report within 24 hours.

Click for more on EU CRA regulations:

Products with digital elements for the EU market: a practical guide to the Article 14 reporting obligation

Compliance alert: the EU CRA vulnerability reporting obligation arrives early, with only seven days to go

The EU CRA is about to take effect: the new cybersecurity threshold exporters to Europe must address

Full analysis of CRA product scope: is your product regulated by the EU Cyber Resilience Act?

Only three months until the CRA takes effect: vulnerability reporting obligations apply from 11 September 2026