Cyber Resilience Act — incident reporting
Date to be confirmed · application
What changes?
Report actively exploited vulnerabilities and severe incidents under the CRA reporting rules.
Who is affected?
EU-market manufacturers of covered products with digital elements, including relevant small software firms
When?
Date to be confirmed. Already applicable.
What to do
- Check whether your business matches this scope: EU-market manufacturers of covered products with digital elements, including relevant small software firms
- Establish vulnerability triage and the required ENISA reporting workflow.
- Confirm exemptions, thresholds and transitional arrangements in the linked primary source before implementing changes.
- Assign a responsible person and keep evidence of your applicability assessment and preparation.
Existing tools and providers
Snyk
Primary source
Cyber Resilience Act 2024/2847 Art 14 (CELEX 32024R2847)
Checked 11 October 2026. A fresh date confirmation was not established. Do not rely on a date from an older summary.