The Cyber Resilience Act (EU Regulation 2024/2847) applies in phases. From 11 September 2026 manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours, via ENISA's single reporting platform. Full application, with product requirements and CE marking, follows on 11 December 2027.
Who is in scope. Manufacturers, importers and distributors. An OEM integrating a PLC, HMI or router should require component suppliers to run clear vulnerability handling and firmware update processes.
What to do now. Inventory connected components, name a security contact per supplier, define who decides and submits a report, set a channel to the end customer.
Choosing CRA-ready components. Published disclosure policy, signed and remotely managed firmware updates, security documentation and IEC 62443 references.
• Does the CRA cover products already sold?
Yes, reporting obligations also apply to products already on the market. •
• How fast must an exploited vulnerability be reported?
Early warning within 24 hours.
• Who receives the report?
The coordinating CSIRT and ENISA via the single reporting platform.
• What are the penalties?
Up to €15 million or a share of worldwide turnover.
