EU Cyber Resilience Act Reporting Obligations Take Effect for Actively Exploited Vulnerabilities

Enterprise software vendors and hardware manufacturers have largely treated the European Union’s Cyber Resilience Act as a 2027 compliance problem. That timeline is no longer accurate. As of September 11, 2026, the CRA’s Article 14 reporting obligations are legally enforceable, requiring any manufacturer with digital products on the EU market to disclose actively exploited vulnerabilities to regulators within 24 hours of discovery. The European Union Agency for Cybersecurity (ENISA) activated its Single Reporting Platform on Wednesday morning, shifting the legislation from a theoretical framework into an active regulatory mechanism.[1][3][4]

The CRA was formally adopted to address the chronic lack of security updates in connected devices, but its rollout is staggered. While the core cybersecurity-by-design requirements and CE marking mandates do not apply until December 11, 2027, the vulnerability disclosure window was fast-tracked by 15 months. The rules apply to any hardware or software product with digital elements sold in the EU, regardless of where the manufacturer is headquartered.[2][4]

The reporting mechanism imposes one of the tightest disclosure windows in global cybersecurity regulation. When a manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting their product, they must submit an early warning through the ENISA Single Reporting Platform within 24 hours. A full technical notification is required within 72 hours. Finally, the manufacturer must submit a conclusive report no later than 14 days after a corrective measure—such as a software patch—becomes available.[1][3]

The mandate is not retroactive, meaning companies do not need to report exploits they knew about before the deadline. As legal analysts at Goodwin noted, "A manufacturer does not need to report an event if it was already aware of the active exploitation or incident before 11 September 2026." However, the obligation applies immediately to any new discovery, even if the underlying flaw existed in the product for years.[2]

Failure to meet these deadlines carries severe financial consequences. According to the regulatory framework, non-compliance with the reporting obligations can trigger administrative fines of up to €15 million, or 2.5% of a company’s total worldwide annual turnover for the preceding financial year, whichever figure is higher. National Computer Security Incident Response Teams (CSIRTs) across member states will coordinate the intake and enforcement alongside ENISA.[2][4]

The immediate enforcement has created a stark dividing line between commercial manufacturers and the open-source community. While commercial entities are now on the clock, open-source software stewards are explicitly exempt from the September 2026 deadline, granting them a temporary reprieve from the strict reporting windows.[1]

The European Commission's framework clarifies that open-source software stewards do not carry a legal reporting burden until December 11, 2027. However, the mandate for commercial entities is absolute. "As a rule, if an organization distributes its products anywhere in the EU, and if its products have any kind of network connectivity, then that organization is subject to the CRA," noted Dark Reading, highlighting that companies do not need to be physically based in Europe to face the new reporting windows.[1][4]

Security vendors are already positioning the deadline as a catalyst for overhauling corporate vulnerability management. The practical challenge for enterprise teams is no longer drafting policy, but building the continuous visibility required to separate theoretical exposures from active exploits. If a company cannot definitively prove when it first learned of an exploit, it cannot prove it met the 24-hour reporting window.[3][4]

The activation of the ENISA Single Reporting Platform transforms European market access requirements immediately. Procurement teams and enterprise buyers are expected to use the new reporting baseline as a standard contractual requirement, forcing manufacturers to instrument their software supply chains for rapid disclosure. With the platform now live and the 24-hour countdowns enforceable, the grace period for product security in the European market has officially expired.[4]