On this page
Published by horak. Attorneys at law / Patent attorneys
2026 legal update / Reviewed 12 November 2026
Manufacturers of covered products with digital elements must now assess actively exploited vulnerabilities and severe security incidents under the CRA reporting regime.
Reporting starts before the main product regime
The Commission confirms that reporting obligations apply from 11 September 2026, while the main CRA obligations apply from 11 December 2027. The reporting rules also affect relevant products already available on the EU market.
Build a coordinated reporting process
The Commission describes early warning within 24 hours and notification within 72 hours. Final-report timing differs between actively exploited vulnerabilities and severe incidents. Organisations should assess the precise trigger and coordinate CRA reporting with other potentially applicable regimes, rather than assuming one notification resolves every obligation.
Four practical examples
Illustrative scenarios, not reports of client mandates. The appropriate response depends on the facts and applicable law.
Actively exploited flaw
A software vendor identifies exploitation in a supported version. It needs a documented awareness time and a coordinated assessment with its security team.
Older product
A manufacturer should not assume that a device released before September 2026 is automatically outside the reporting regime.
Multiple reporting duties
An incident also involves personal data. The business assesses GDPR and CRA requirements separately and aligns the factual accounts.
Supplier notification delay
A component supplier provides late information. The manufacturer reviews escalation terms and its own reporting process.
Practical next step
Identify the systems, products or contracts affected, assign a responsible owner and preserve the documents supporting your assessment. Read our related service page for the scope of legal support.