The Cyber Resilience Act (“CRA”) entered into force on 10 December 2024 and introduces mandatory cybersecurity standards for hardware and software products made available on the EU market. The CRA can also apply to organisations established outside the EU where their products are made available on the EU market.

The CRA applies to Products with Digital Elements (“PDEs”), being any hardware or software that can connect directly or indirectly to a device or network, and includes products such as laptops, smart devices and mobile applications.

Full technical product compliance rules under the CRA will not come into effect until December 2027. However, as of 11 September 2026, products made available in the EU market must report two specific categories of security events affecting their products:

Actively Exploited Vulnerabilities

Any software or hardware flaw where reliable evidence shows a malicious actor is actively exploiting the vulnerability without the system owner’s permission.

Severe Incidents

Any operational security incident that negatively affects, or could affect, a product’s security functions, data confidentiality or system integrity. The CRA focuses on whether the incident negatively affects, or is capable of negatively affecting, the product’s ability to protect the availability, authenticity, integrity or confidentiality of data or functions.

Further to the above two central security events, the CRA imposes a duty to report further incidents as follows:

Third-Party Components

For any actively exploited vulnerability or severe incident which occurs in a third-party component integrated into a product, the final product manufacturer is required to report this incident once it is confirmed that the product is affected.

Legacy Products

Products placed on the market prior to 11 December 2027 are exempt from design rules, but are fully subject to reporting obligations if currently available on the EU market.

It is important to note that the reporting obligation is triggered upon a manufacturer becoming aware of the incident or vulnerability.

Manufacturers need to be acutely aware of the stages of reporting imposed by the CRA, which are to be submitted through the European Union Agency for Cybersecurity’s Single Reporting Platform, and which are divided into the following stages:

Early Warning Notification

This requires a report to be submitted within 24 hours of becoming aware of an active exploit or severe incident. This can be considered a baseline notice highlighting suspected malicious intent and impacted Member States, pending a deep technical analysis. This timeline applies to both Actively Exploited Vulnerabilities and Severe Incidents.

Detailed Notification

This report is to be submitted within 72 hours of initial awareness of the vulnerability or incident. This report will provide an initial severity assessment, identify the root cause, identify the nature of the event and finally identify temporary mitigations or workarounds for the incident. This timeline also applies to both Actively Exploited Vulnerabilities and Severe Incidents.

Final Report

This report shall contain the root-cause analysis, patch details and corrective actions taken in respect of the incident. The timelines vary for Actively Exploited Vulnerabilities and Severe Incidents and are as follows:

• Actively Exploited Vulnerabilities – Submitted no later than 14 days after a corrective measure is made available
• Severe Incidents – Submitted within one month after the incident notification.

What organisations need to be aware of is that while CRA reporting obligations typically rest with the manufacturer of a PDE, the CRA’s definition of manufacturer can include organisations who market a PDE under their own name or trademark, or who make substantial modifications to the product. It is therefore important all organisations dealing with PDEs consider their activities to ensure they are not captured within the scope of a manufacturer, which may cause them to fall foul of these obligations going forward.

We recommend that organisations take several steps to protect their business following these obligations under the CRA becoming operational, including that they consider the inventory of products which form part of their business operations and clearly identify those products which would fall within the definition of PDEs where those products are either manufactured in the EU or made available on the EU market. We further recommend organisations ensure they have appropriate mechanisms in place to designate who may determine if an event may be considered an Actively Exploited Vulnerability or a Severe Incident and ensure that adequate internal decision making is afforded to enable them to meet their reporting obligations.