Cyber Resilience Act: Since 11 September 2026 You Must Report Exploited Vulnerabilities – What Software Owners Need to Do Now

Short answer (updated October 2026). The EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) applies in full from 11 December 2027, but its reporting obligations have applied since 11 September 2026 – including for software already on the market. If you sell software or a connected product in the EU under your own name, you must report every actively exploited vulnerability and every severe incident through ENISA's Single Reporting Platform: an early warning within 24 hours, a notification within 72 hours and a final report 14 days after a fix (vulnerabilities) or one month after the notification (incidents). Custom software is in scope, and the manufacturer is usually the company that commissioned it, not the agency that built it. From December 2027, an SBOM, a vulnerability disclosure policy and at least five years of free security updates follow. Fines reach €15 million or 2.5% of worldwide turnover.

This article summarises the regulation, the European Commission's FAQ (version 1.4 of 4 September 2026) and ENISA's guidance, and turns them into a setup you can build now. It is not legal advice.

Timeline

There is no postponement. The Commission's "Digital Omnibus" proposal of November 2025 aims to build a single reporting entry point for several EU laws on top of the CRA platform, but as of October 2026 it does not change the CRA dates.

Does the CRA apply to your software?

The CRA covers "products with digital elements" that are made available on the EU market and whose intended use includes a data connection (Art. 2): installed software, mobile apps, firmware, connected devices. Some typical cases, based on the regulation and the Commission FAQ:

Who is the manufacturer? Whoever develops a product, or has it developed, and markets it under its own name or trademark (Art. 3(13)). If you commission software from an agency and sell it under your brand, you are the manufacturer and carry the reporting obligation. A distributor or anyone else who substantially modifies a product becomes its manufacturer too (Art. 21–⁠22).

What you must report since 11 September 2026

Details that matter in practice (Art. 14, Commission FAQ):

• Only actively exploited vulnerabilities. A vulnerability you find yourself or that a researcher reports is not reportable until there is reliable evidence of malicious exploitation; you may report it voluntarily (Art. 15).
• Third-party components count. If a vulnerability in a library you use is exploited and is exploitable in your product, you must report it, even though another manufacturer has to report it as well.
• Products already on the market are covered. Reporting applies to all in-scope products, including those placed on the market before 11 December 2027, from the moment you become aware on or after 11 September 2026.
• One channel. Reports go through ENISA's Single Reporting Platform to the CSIRT of the member state where your main establishment is, and at the same time to ENISA. At launch the platform had web forms only, no API, and login runs through EU Login with multi-factor authentication. Register before you need it: an incident at 2 a.m. on a Saturday is the wrong moment to set up accounts.
• Users must be informed about the vulnerability or incident and the measures to take, if appropriate in a machine-readable format.

What applies from December 2027

From 11 December 2027 the essential requirements of Annex I apply to new products. The ones that shape your development process:

• SBOM. A software bill of materials in a commonly used, machine-readable format, covering at least the top-level dependencies. It is part of the technical documentation and goes to authorities on request; publishing it is optional. Germany's BSI recommends CycloneDX 1.6 or SPDX 3.0.1 in its technical guideline TR-03183-2 (non-binding).
• Coordinated vulnerability disclosure. A published policy and a contact address for vulnerability reports. A security.txt file (RFC 9116) on your website is a simple way to provide the contact.
• Security updates for the support period, at least five years unless the product is expected to be used for a shorter time (Art. 13(8)), free of charge and, where technically feasible, separate from feature updates. Fixed vulnerabilities must be disclosed.
• Due diligence on components, including open source, and reporting of vulnerabilities you find to their maintainers.
• Conformity assessment. Most products use self-assessment. "Important" products (operating systems, browsers, password managers, VPNs, identity management, firewalls and others listed in Annex III) and "critical" products (Annex IV) need standards or a notified body. Implementing Regulation (EU) 2025/2392 describes the categories.

Penalties

Micro and small enterprises cannot be fined for missing the 24-hour early warning (Art. 64(10)); the 72-hour notification and final report still apply to them. Article 64 itself is not among the provisions brought forward to 2026, so some commentators conclude that fines can only be imposed from December 2027. The Commission has not commented on this; do not plan around it.

In Germany, the implementation bill (Bundestag printed paper 21/6134) designates the BSI as market surveillance authority. As far as we could verify, it had not yet been promulgated by mid-October 2026.

How ready are companies?

• In a Bitkom survey of 1,003 German companies (September 2026), 67% knew the CRA, but only 29% understood what it means for them; 28% had not heard of it.
• In ENISA's SBOM survey (June 2026), 78% of organisations had started with SBOMs, but 44% were still at a pilot or limited stage; 44% use CycloneDX, 29% SPDX.

Checklist: what to set up now

1. List your products on the EU market, including older versions still in use, and decide for each whether you are the manufacturer.
2. Register on the Single Reporting Platform: a primary contact and deputies (up to 20), EU Login with multi-factor authentication.
3. Write the reporting runbook: who decides that a vulnerability is "actively exploited", who files the 24-hour warning, who covers weekends and holidays. The clock starts when you become aware, not when the team is back at work.
4. Generate an SBOM for every release in your CI pipeline (CycloneDX or SPDX), stored with the release.
5. Monitor your dependencies continuously against CVE, the EU Vulnerability Database and exploitation signals, so an exploited component reaches you within hours, not at the next audit.
6. Publish a vulnerability disclosure policy and a contact, for example via security.txt.
7. Prepare user notifications: templates, channels and a contact list per product and customer.
8. Define the support period and a way to ship security updates separately from feature releases.
9. Fix responsibilities in contracts with your development partners: who monitors, who fixes, who reports, response times. For custom software, record the agreed deviations in the technical documentation.
10. Plan for December 2027: conformity assessment, technical documentation, CE marking for new products.

Common myths

1. "The CRA only applies from 2027." Reporting has applied since 11 September 2026.
2. "Products already on the market are exempt." Not from reporting.
3. "Our SaaS is covered." Only if it is remote data processing for a product; otherwise NIS2 is the relevant law.
4. "Custom software is out of scope." It is in scope; only two requirements can be waived by contract.
5. "The agency that built it is the manufacturer." The manufacturer is whoever markets the product under its name.
6. "The SBOM must be public and list every dependency." Top-level dependencies are the minimum, and the SBOM goes to authorities on request.
7. "Every CVE in a dependency must be reported." Only actively exploited ones that are exploitable in your product.
8. "Small companies don't have to report." They do; they are only spared fines for a late 24-hour warning.
9. "We report to the BSI directly." Reports go through the ENISA platform, which routes them to the responsible CSIRT.
10. "The final report is always due after 14 days." That is for vulnerabilities after a fix; for incidents it is one month after the notification.

How we help

SDH builds and runs software for companies that are, under the CRA, its manufacturers. We set up SBOM generation and dependency monitoring in your CI/CD, run managed DevOps with 24/7 monitoring that turns an exploited component into an alert within hours, build security into the architecture as described in our security and compliance framework, and help write the reporting runbook and contracts through CTO as a Service. If you are not sure whether your product is in scope or who reports what, talk to us. For the pipeline side, see also our article on DevOps pipeline security gaps, and for what compliance means for a new product's budget, our guide to MVP development cost in 2026.

FAQ

When do the CRA reporting obligations start?

On 11 September 2026. Since then, manufacturers must report actively exploited vulnerabilities and severe incidents in their products, including products placed on the market before the CRA fully applies on 11 December 2027.

What are the CRA reporting deadlines?

An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report no later than 14 days after a fix is available (vulnerabilities) or within one month after the notification (incidents).

Does the Cyber Resilience Act apply to SaaS?

Standalone SaaS is not a product with digital elements and falls under NIS2. It is covered only as remote data processing that a product needs to perform its functions.

Is an SBOM mandatory under the CRA?

Yes, from 11 December 2027 for new products: a machine-readable SBOM covering at least the top-level dependencies, kept in the technical documentation. It does not have to be published.

What are the penalties under the CRA?

Up to €15 million or 2.5% of worldwide annual turnover for breaches of the essential requirements and the obligations of Articles 13 and 14, including reporting. Micro and small enterprises cannot be fined for missing the 24-hour early warning.

Sources

• Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of 20 November 2024
• European Commission, FAQs on the Cyber Resilience Act, version 1.4, 4 September 2026
• European Commission, CRA reporting obligations, September 2026
• European Commission, Guidance to support CRA implementation, July 2026
• ENISA, Single Reporting Platform
• ENISA, SBOM adoption: state of play 2026, June 2026
• BSI, Technical Guideline TR-03183
• Bitkom, Cyber Resilience Act: 3 in 10 companies prepared, September 2026
• European Commission, EU Vulnerability Database launched, May 2025

Categories

About the author

Pavlo Yablonskyi

CTO & Co-Founder

View full profile

CTO & co-founder at Software Development Hub. Software engineer with 20+ years of experience. Python/Django-geek, software architect and IT team leader. Staying up-to-date with tech trends. Strong technical skills and diverse expertise in software structure design, development, team management and cybersecurity.

View full profile