Since 11 September 2026, any manufacturer of a product with digital elements sold in the EU, including UK software and device makers with no EU office, has had to report actively exploited vulnerabilities and severe security incidents through the Cyber Resilience Act’s Single Reporting Platform: an early warning within 24 hours of becoming aware, a fuller notification within 72 hours and a final report afterwards. The rest of the Act does not apply until 11 December 2027, but the reporting clock is already running, and it covers products already on the market.
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is the EU’s horizontal cybersecurity law for hardware and software products. It entered into force on 10 December 2024. A product with digital elements is, broadly, any software or hardware product, and its remote data processing solutions, whose intended use includes a data connection to a device or network.
Which UK firms are caught?
Any UK firm that makes a product with digital elements available on the EU market. In regulated sectors that commonly includes:
- fintech and wealth-tech firms distributing installable applications, desktop software or SDKs to EU clients;
- legaltech and practice-software vendors with EU customers for on-premises or desktop products;
- healthtech firms supplying connected devices or installed clinical software into EU markets;
- any firm whose mobile app is available in EU app stores and is offered commercially.
Pure software as a service is generally outside the CRA. However, remote data processing that is essential for a product’s functions, such as the cloud service behind a connected device or an installed application, is treated as part of that product. Firms that sell only hosted services should confirm that position rather than assume it.
What exactly must be reported, and when?
The European Commission’s guidance sets out the timeline. For an actively exploited vulnerability, meaning a vulnerability for which there is reliable evidence that a malicious actor has exploited it, the manufacturer must submit:
- an early warning within 24 hours of becoming aware;
- a vulnerability notification within 72 hours;
- a final report no later than 14 days after a corrective measure is available.
For a severe incident affecting the security of the product, the timeline is the same 24 and 72 hours, with a final report within one month of the 72-hour notification.
Reports are made once, through the CRA Single Reporting Platform, addressed to the national computer security incident response team (CSIRT) responsible for the manufacturer and shared with ENISA, the EU cybersecurity agency.
Why do products already on the market matter so much?
Because they are where the vulnerabilities are. The Act’s transitional provisions apply the reporting obligations to all in-scope products placed on the market before 11 December 2027, with no cut-off for older products. A desktop client released in 2019 and still supported, or a device firmware version that customers have never updated, is covered if a vulnerability in it is actively exploited.
For many UK software firms this is the first time any law has required them to report a vulnerability in their own product within a fixed time. The UK’s product security regime for consumer connectable products, in force since 29 April 2024, already requires a published way to report vulnerabilities, but it does not impose a 24-hour reporting duty of this kind.
What does a firm need in place to meet a 24-hour deadline?
It needs to find out quickly, decide quickly and report accurately. That depends on three capabilities most smaller software firms do not yet have in a formal sense.
A way to hear about vulnerabilities. A coordinated vulnerability disclosure policy is a published statement of how external researchers and customers can report a security flaw and what the firm will do with it. Without one, reports arrive at a sales inbox, a support ticket or social media, and the 24 hours may have passed before anyone with authority sees them.
A way to know your own weaknesses first. Regular penetration testing of the product, its APIs and its cloud back end finds vulnerabilities before attackers do, when fixing them carries no reporting duty at all. A component inventory, often called a software bill of materials, tells the firm within hours whether a newly published flaw in an open-source library affects its product.
A decision path. Someone must decide whether a vulnerability is actively exploited and whether an incident is severe, and must be authorised to submit the early warning. That decision belongs in the firm’s incident response plan, with a named owner and a deputy.
How does this sit alongside UK requirements?
Closely. The UK’s Cyber Security and Resilience Bill, which we discussed in July, adopts a similar 24-hour initial and 72-hour full reporting rhythm for regulated service providers. Under UK GDPR, a personal data breach must be reported to the ICO within 72 hours where feasible. A firm that builds one reporting capability, with clear triggers for each regime, avoids running three separate processes under pressure.
What to do this quarter
- Decide formally whether each of your products is a product with digital elements placed on the EU market, and record the reasoning.
- Publish a coordinated vulnerability disclosure policy and a monitored security contact.
- Build or update a component inventory for each product so you can assess new vulnerabilities in hours.
- Commission penetration testing of the product, its APIs and its back end, starting with the most widely deployed version.
- Name the person who decides on and submits a CRA early warning, and a deputy.
- Map your CRA, UK GDPR and contractual reporting duties into one incident response procedure.
How Rhentech helps
Our penetration testing service tests products and their supporting infrastructure the way an attacker would, so that vulnerabilities are found and fixed before they become reportable. Our incident response service designs the triage and reporting path that a 24-hour deadline requires, and a cybersecurity audit assesses whether your development and vulnerability-handling processes will meet the Act’s wider requirements from December 2027.
If your firm sells software or connected products into the EU, book a free initial consultation and we will help you work out what the CRA requires of you now and in 2027.
Frequently asked questions
What changed on 11 September 2026 under the Cyber Resilience Act?
Manufacturers of products with digital elements became obliged to report actively exploited vulnerabilities and severe incidents affecting the security of their products. Reports go through the CRA Single Reporting Platform: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later.
Does the Cyber Resilience Act apply to UK companies?
Yes, if they make products with digital elements that are placed on the EU market. Being incorporated in the UK does not take a manufacturer out of scope; the trigger is making the product available in the EU.
Do the reporting duties cover products sold before 2026?
Yes. The Act’s transitional provisions apply the reporting obligations to in-scope products placed on the market before 11 December 2027, so software and devices already in customers’ hands are covered.
Is software as a service covered by the Cyber Resilience Act?
Pure software as a service is generally outside the Act. Remote data processing that is essential to a product’s functions, such as the cloud back end of a connected device or installed application, is treated as part of that product.
When does the rest of the Cyber Resilience Act apply?
The Act entered into force on 10 December 2024. The reporting obligations apply from 11 September 2026, and the main obligations, including the essential security requirements and conformity assessment, apply from 11 December 2027.
Sources
- European Commission, Cyber Resilience Act: reporting obligations, accessed September 2026.
- European Commission, Cyber Resilience Act, policy page, accessed September 2026.
- Regulation (EU) 2024/2847 (the Cyber Resilience Act), Official Journal, 20 November 2024, including Article 14 and Article 69(3).
- DSIT, Incident reporting factsheet, Cyber Security and Resilience Bill, GOV.UK.
- UK GDPR Article 33, notification of a personal data breach.
Reviewed 20 October 2026.