EU Cyber Resilience Act's First Enforcement Deadline Hits September 11

The European Union's Cyber Resilience Act reaches its first major enforcement milestone on September 11, 2026, when reporting obligations for actively exploited vulnerabilities and severe security incidents take effect. This is distinct from — and arrives well ahead of — the CRA's main compliance obligations, which apply starting December 11, 2027; September 11 marks only the beginning of active enforcement, specifically around incident and vulnerability reporting.

The Staged Reporting Timeline, Specifically

• An early warning must be submitted within 24 hours of a manufacturer becoming aware of an actively exploited vulnerability or severe incident
• A full notification follows within 72 hours, providing more complete detail than the initial early warning
• A final report is due no later than 14 days after a corrective measure becomes available for an actively exploited vulnerability, or within one month for a severe incident

Who Reports, and How

Manufacturers of products with digital elements report only once, through the CRA Single Reporting Platform, to the Computer Security Incident Response Team (CSIRT) in the member state where they have their main establishment. That information is then made available simultaneously to ENISA, the EU's cybersecurity agency — a single-submission design meant to avoid manufacturers needing to separately notify multiple national authorities for the same incident.

What This Means If You Manufacture or Sell Digital Products in the EU

With the deadline landing within days, any organization manufacturing products with digital elements sold in the EU market needs a concrete, tested internal process for the 24-hour/72-hour/14-day reporting chain now, not a policy document that's never been exercised. The tight 24-hour early-warning window in particular means the internal escalation path from 'a vulnerability is discovered or actively exploited' to 'the report is actually filed' needs to be fast and unambiguous, which is a different operational bar than most organizations' existing incident response processes were built to meet.