Cyber Resilience Act Reporting Obligations

CRA Article 14: Manufacturer Reporting Obligations under the CRA

Article 14 establishes the manufacturers’ reporting obligations, with two parallel reporting tracks that apply when manufacturers become aware of specific security events. 

Track 1: Actively exploited vulnerabilities

Actively exploited vulnerabilities refer to situations where a malicious actor is already taking advantage of a flaw in the product to cause harm. This track applies when there is confirmed, ongoing exploitation affecting users or other persons, such as an authentication bypass enabling unauthorized access or privilege escalation leading to data theft in a user‑facing component. When manufacturers detect such active misuse, they must quickly assess the nature and impact of the exploitation and initiate immediate corrective or mitigating measures to protect users and limit further damage.

Vulnerability reporting timeline (Article 14(2))

Track 2: Severe incidents impacting product security

Severe incidents refer to cybersecurity events that affect, or could affect, the security of the product or the manufacturer’s development, production, or maintenance processes. These incidents may not involve active exploitation but are considered severe when they pose a significant cybersecurity risk for users or other persons. Examples include malicious code injected into updates, compromise of code‑signing keys or signing services, or breaches of the source‑code repository or build system that impact shipped artifacts.
An incident is classified as severe when it meets either of the following conditions:

• It harms the product’s ability to protect the availability, authenticity, integrity, or confidentiality of important or sensitive data or functions, or
• It leads (or could lead) to the introduction or execution of malicious code in the product or in a user’s systems.

Severe Incident Reporting Timeline (Article 14(4))

How and where to report: Single Reporting Platform

For both tracks, manufacturers report via the Single Reporting Platform. The notification becomes simultaneously accessible to the national coordinator CSIRT and to ENISA.

Deadlines, applicability and legacy products

Reporting obligations under Article 14 apply from 11 September 2026. Manufacturers must report actively exploited vulnerabilities and severe incidents for all products with digital elements that fall within the scope of the CRA, including products placed on the market before 11 December 2027 (see Article 69(3)).

Notification to Impacted Users

After becoming aware of an actively exploited vulnerability or a severe incident, manufacturers must inform impacted users.

Reporting vulnerabilities in third‑party components

Where a product contains an actively exploited vulnerability originating from an integrated component, the product manufacturer must notify it. The component manufacturer must also notify it if the component has been placed on the market.

Delegated acts and CSIRT coordination

A delegated act supplements the CRA by defining terms and conditions under which the first (coordinator) CSIRT receiving a notification may delay sharing it with other Member States’ CSIRTs. See the official text here: Delegated act.

Practical guidance for manufacturers

• Getting started: build awareness and roles through CRA Training and read the CRA Essential Guide.
• Process in place: use a gap analysis with the CRA Readiness Assessment.
• High maturity: prepare for assurance schemes such or Cyber Resilience Mark or EUCC Certification.
• End‑to‑end support: follow the maturity pathway on our CRA Compliance Services page.

FAQ about CRA Reporting

1) What must manufacturers report under CRA Article 14?
Actively exploited vulnerabilities and severe security incidents, submitted via the Single Reporting Platform.

2) How fast do manufacturers need to report?
The clock starts when the manufacturer becomes aware of the vulnerability or incident. Follow the specific timelines defined by the platform and guidance once available.

3) Do legacy products need to be reported?
Yes, if they fall within the CRA’s scope, including products placed on the market before 11 December 2027.

4) What if the vulnerability comes from a third‑party component?
Both the product manufacturer and the component manufacturer (if the component is placed on the market) have notification duties.

5) Do manufacturers need to notify users as well as authorities?
Yes. Impacted users must be informed after the manufacturer becomes aware of the issue.

Additional information reading

• CRA Standards Mapping
• CRA Self-Assessment Tool
• CRA Latest Updates and Articles