Guide · Cyber Resilience Act
Cyber Resilience Act: the reporting duty that already applies
The Cyber Resilience Act applies in full from 11 December 2027, but its reporting duty in Article 14 has applied since 11 September 2026. From that date a manufacturer must send an early warning of any actively exploited vulnerability or severe incident within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report after that.
A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.
The figure behind it
Under Article 13(8) the support period for a product with digital elements must be at least 5 years, and each security update must stay available for at least 10 years or the rest of the support period, whichever is longer (Article 13(9)). Source: Regulation (EU) 2024/2847, Article 13(8) and (9), EUR-Lex text as held by Rekvira (corpus of 2 September 2026)
The text below is the Cyber Resilience Act (Regulation (EU) 2024/2847) as Rekvira returned it on 24 September 2026. If you sell connected hardware or software in the EU, from anywhere, the questions are the same: which date binds you now, and what your role requires.
When does the Cyber Resilience Act apply?
Article 71 staggers it. The general date is late 2027, but two parts came earlier:
"This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026." (Article 71(2))
Chapter IV applies: notification of conformity assessment bodies (Articles 35 to 51)
Article 14 applies: reporting of actively exploited vulnerabilities and severe incidents
The rest of the Regulation applies, including the essential requirements in Annex I
So a manufacturer with products on the EU market already has a live reporting duty, more than a year before the design and conformity rules bind. The reporting clock is the part to set up now.
What must a manufacturer report, and how fast?
Article 14 covers two events: an actively exploited vulnerability in the product, and a severe incident having an impact on its security. Both go "simultaneously to the CSIRT designated as coordinator" and to ENISA, through the single reporting platform of Article 16.
| Step | Actively exploited vulnerability (Article 14(2)) | Severe incident (Article 14(4)) |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Within 24 hours of becoming aware, including whether unlawful or malicious acts are suspected |
| Notification | Within 72 hours, with general information on the product, the exploit and the corrective or mitigating measures | Within 72 hours, with an initial assessment and the measures taken |
| Final report | No later than 14 days after a corrective or mitigating measure is available | Within one month after the incident notification |
read_unit on 24 September 2026. Each later step applies "unless the relevant information has already been provided".What makes an incident "severe" is defined in Article 14(5): it affects, or could affect, the product's ability to protect "the availability, authenticity, integrity or confidentiality of sensitive or important data or functions", or it has led or could lead to malicious code in the product or in a user's systems.
Where to file depends on where your cybersecurity decisions are "predominantly taken". A manufacturer with no main establishment in the Union files with the CSIRT of the Member State that hosts its authorised representative for most of its products, then, in order, its main importer, its main distributor, or where most of its users are (Article 14(7)).
24 h
early warning, for a vulnerability or a severe incident
72 h
notification with general information and measures
14 days
final report for a vulnerability, after the fix is available
read_unit on 24 September 2026.What else does Article 13 ask of manufacturers?
Article 13 has 25 paragraphs. Most of them start to bind on 11 December 2027, and they shape products being designed today. A selection:
| Paragraph | What it requires |
|---|---|
| 13(1) | Design, develop and produce the product in line with the essential cybersecurity requirements in Part I of Annex I |
| 13(2), (3) | A documented cybersecurity risk assessment, updated during the support period |
| 13(5) | Due diligence on third-party components, including free and open-source software |
| 13(8) | A support period that reflects expected use, "at least five years" unless the product is expected to be in use for less |
| 13(9) | Keep each security update available for at least 10 years or the rest of the support period |
| 13(13) | Keep the technical documentation and EU declaration of conformity for at least 10 years |
| 13(17) | A single point of contact for users, including for reporting vulnerabilities |
| 13(19) | State the end date of the support period, at least month and year, at the time of purchase |
A "manufacturer" is anyone who "develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge" (Article 3(13)). Putting your brand on a white-label device makes you one.
What about importers and distributors?
Rekvira's heading lookup returns one obligations article for each: Article 19 for importers and Article 20 for distributors. Both lists also return Article 21, "Cases in which obligations of manufacturers apply to importers and distributors". Read it whole before you rely on being only an importer or distributor: it sets the cases in which you take on the manufacturer's duties.
Recorded run
The question:What does the Cyber Resilience Act require of manufacturers, importers and distributors, and from when?
get_workflow(workflow_id="cra-economic-operator-obligations")Load the CRA economic-operator playbook.
read_unit(regulation="cra", kind="article", number="71")Entry into force and the application dates.
"This Regulation shall apply from 11 December 2027." and "Article 14 shall apply from 11 September 2026"
read_unit(regulation="cra", kind="paragraph", article="2", number="1")Scope: which products the Regulation covers.
"products with digital elements made available on the market"
read_unit(regulation="cra", kind="article", number="14")The reporting obligations of manufacturers, whole.
"within 24 hours of the manufacturer becoming aware of it" and "no later than 14 days after a corrective or mitigating measure is available"
lookup_obligations(regulation="cra", role="manufacturer")Which article headings name the manufacturer.
Manufacturer headings: "Obligations of manufacturers" (Article 13) and "Reporting obligations of manufacturers" (Article 14), plus Articles 21 and 22.
lookup_obligations(regulation="cra", role="importer")The same for importers.
Importer heading: "Obligations of importers" (Article 19).
lookup_obligations(regulation="cra", role="distributor")The same for distributors.
Distributor heading: "Obligations of distributors" (Article 20).
read_unit(regulation="cra", kind="article", number="13")The manufacturer's obligations, whole.
Article 13 whole, 25 paragraph pinpoints, including "the support period shall be at least five years"
verify_citation(regulation="cra", citation="Article 14(1)", quote="A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator")Check the reporting sentence before quoting it.
Quote found for the Article 14(1) sentence quoted at the top of this page.
read_unit(regulation="cra", kind="paragraph", article="3", number="13")Who counts as a manufacturer.
Real calls to Rekvira’s production server, captured 24 September 2026. Corpus as of 2 September 2026.
Limits
Rekvira holds the Cyber Resilience Act as published, not the Commission's implementing and delegated acts or harmonised standards, and not national rules on penalties. It returns the text and its pinpoints. Whether your product is in scope, which class it falls into and how you report are for your product security and legal teams.
Do this in your assistant
Use Rekvira to set up our Cyber Resilience Act reporting. Read Articles 14 and 16 and Article 71.
Give me the reporting steps for an actively exploited vulnerability and for a severe incident,
each with its deadline and the exact words of the Article, and tell me which CSIRT we file with
under Article 14(7) given where our cybersecurity decisions are taken.Paste this into Claude, ChatGPT, Cursor or any MCP client connected to https://mcp.rekvira.com/mcp. Sign in once with your email to start (free).Install steps for each client
Start with a free account.
One email to sign in, no API key, and free during the beta.
https://mcp.rekvira.com/mcp