EU CRA reporting rules take effect for connected products
Manufacturers of connected hardware and software sold in the European Union are now subject to new cybersecurity reporting obligations under the EU Cyber Resilience Act.
Under Article 14 of the Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe security incidents affecting products with digital elements from 11 September 2026.
New reporting deadlines
Manufacturers must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe security incident. A more detailed notification must follow within 72 hours.
Notifications are submitted through the CRA Single Reporting Platform operated by the European Union Agency for Cybersecurity, ENISA. The platform became operational on 11 September.
Impact on connected security products
The requirements apply to products with digital elements made available on the EU market, including connected hardware and software. This can include networked physical security technologies such as cameras, access control systems, intercoms, sensors and other connected security devices where they fall within the scope of the regulation.
The reporting obligations also apply to products placed on the EU market before the CRA becomes fully applicable in December 2027.
The broader CRA introduces cybersecurity requirements covering secure product development, vulnerability handling and product support. Most provisions will apply from 11 December 2027, while the vulnerability and incident reporting requirements have now entered into force.
