The Cyber Resilience Act (Regulation (EU) 2024/2847) has long been described as a 2027 matter. Since 11 September 2026, however, part of it already applies: manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents affecting the security of their products, within very short deadlines and through a common European procedure. Here is what that means in practice, and what remains to be prepared before 11 December 2027.
Who does the CRA apply to?
The regulation covers every product with digital elements made available on the EU market, hardware and software alike, as long as it can be connected directly or indirectly to a device or a network. Connected objects, desktop software, mobile apps and network equipment all fall within its scope, including products that were already on the market before the regulation came into force.
The obligations fall first on manufacturers, meaning organisations that design or have a product designed and market it under their own name or trademark. Importers and distributors also have verification duties. Some sectors already covered by specific legislation, such as medical devices or aviation, are excluded, and services delivered remotely are mainly a matter for the NIS2 Directive. Organisations based in the United Kingdom are concerned as soon as they place products on the EU market.
What has applied since 11 September 2026
Article 14 of the regulation covers the reporting of two types of event: actively exploited vulnerabilities, meaning those that a malicious actor is known to have used, and severe incidents that affect the security of the product. In both cases the manufacturer must follow a staged timetable.
| Deadline | What is expected |
|---|---|
| 24 hours | An early warning, sent as soon as the manufacturer becomes aware of the exploited vulnerability or the incident. |
| 72 hours | A full notification, with the information available on the nature of the threat and the measures taken or planned. |
| 14 days | A final report on the vulnerability, no later than fourteen days after a fix or mitigation has been made available. |
| 1 month | A final report on a severe incident, within one month of the notification. |
Reports go through a single reporting platform run by ENISA, the European Union Agency for Cybersecurity, which forwards them to the CSIRT designated as coordinator in each Member State concerned. The manufacturer must also inform affected users and, where relevant, tell them what to do to protect themselves.
An often underestimated point: the 24-hour clock starts when the manufacturer becomes aware of the exploitation. Meeting it requires information to travel quickly from technical teams to the people authorised to report, and those people must be able to coordinate even if part of the information system is affected.
What remains to be prepared before December 2027
On 11 December 2027 the whole regulation will apply. Manufacturers will then have to show that their products meet the essential cybersecurity requirements of Annex I, which cover both the design of the product and the handling of its vulnerabilities throughout its life. In practice this means shipping products with no known exploitable vulnerability and with secure default settings, keeping a software bill of materials up to date, providing security updates throughout a support period that is generally at least five years, and documenting all of this in a technical file.
Every product will need a conformity assessment before it can carry the CE marking. For most products a self-assessment will be enough, but those classed as “important” or “critical”, such as some operating systems, password managers or firewalls, will go through stricter procedures, sometimes involving a notified body.
The penalties are designed to deter. Failure to meet the essential requirements or the reporting obligations can cost up to 15 million euros or 2.5% of worldwide annual turnover, whichever is higher.
Organising reporting without relying on a compromised information system
A severe incident rarely affects the product alone. When the attack also reaches the organisation’s email, directory or video-conferencing tools, the team preparing the early warning ends up improvising on personal messaging apps, with no audit trail and no certainty that the attacker is not reading along. Here the CRA meets NIS2 and DORA, which also impose 24 or 72-hour deadlines and expect organisations to document their decisions.
Whaller RESILIENCE was designed for exactly this scenario. Set up in calm times and independent of your information system, the platform brings the crisis team together in spheres reserved for authorised people, with messaging, video calls and document co-editing. Response sheets, the crisis directory and notification templates can be stored in advance, and every decision is time-stamped, which makes it easier to write the final reports the authorities expect.
For the most sensitive exchanges, such as analysing a vulnerability that has not yet been fixed, Whaller DONJON offers an environment qualified SecNumCloud 3.2 by ANSSI, the French national cybersecurity agency, where development, security and management teams can work together without exposing that information to extraterritorial legislation.
Prepare your crisis team with Whaller RESILIENCE
Further reading
- Whaller RESILIENCE: the full presentation
- Has the password become the weak link in digital collaboration?
- Executive data: what if your biggest cybersecurity blind spot was your collaboration tool?
- European Commission: safer and more secure digital products (11 September 2026)
0 Comments