CRA Reporting Obligations for Products Already on the Market
Most manufacturers have December 11, 2027, in their plans: the date from which all requirements of the Cyber Resilience Act apply in full. Fewer know that one central obligation applies 15 months earlier. Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents. This reporting obligation covers not only new products but also products that are already in use.
Contents
Reporting comes before all other CRA requirements
The Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force on December 10, 2024, and follows a staggered timeline. The full cybersecurity requirements, from security by design through the software bill of materials (SBOM) to CE marking, apply only from December 2027. The legislator brought the reporting obligations under Article 14 forward to September 11, 2026.
This is deliberate. The EU wants an early overview of actively exploited vulnerabilities in connected products. The reporting obligation is therefore the first operational CRA obligation for manufacturers. It applies before conformity assessment, technical documentation, or secure development processes are formally required.
What you must report
Two types of events must be reported: actively exploited vulnerabilities in products with digital elements, and severe incidents having an impact on the security of such products. For both, a staged procedure with fixed deadlines applies. It starts with an early warning notification within 24 hours of becoming aware of the event.
The notification goes simultaneously to the competent national CSIRT and to the European Union Agency for Cybersecurity (ENISA). It is submitted via the single reporting platform that ENISA operates, the Single Reporting Platform. The competent CSIRT is the one designated as coordinator by the Member State where the manufacturer has its main establishment in the Union (Article 14(7) of the CRA).
Our overview of the CRA reporting obligations covers the deadlines, recipients, and procedure in detail. This article focuses on why the reporting obligation also covers the existing product portfolio.
Why products already on the market are covered
This is where many manufacturers misread the CRA. Under Article 69(2), the other CRA requirements (secure development, conformity assessment, CE marking, and more) do not apply across the board to older products. The cut-off date is December 11, 2027. Products with digital elements placed on the market before that date, the legacy products, are subject to the other requirements only if they undergo a substantial modification from that date.
That does not mean legacy products are automatically off the hook. Under the CRA, a substantial modification is a change after placing on the market that affects compliance with the essential cybersecurity requirements or changes the intended purpose. A security-relevant feature update can qualify. An older product can then become subject to the full CRA requirements, even though it was placed on the market before the cut-off date.
For the reporting obligations under Article 14, this limitation does not apply at all. Article 69(3) states expressly that the reporting obligations apply to all products with digital elements within the scope of the CRA placed on the market before December 11, 2027. The fact that the reporting obligation covers legacy products is therefore not an interpretation; it is in the text of the regulation. Machines, controllers, sensors, or software that have already been delivered and are in operation at customer sites have been subject to the reporting obligation since September 2026.
The obligation does not apply retroactively. You do not have to report vulnerabilities whose active exploitation you were already aware of before September 11, 2026. If you become aware of active exploitation only after that date, the reporting obligation applies. This clarification comes from the European Commission's guidance on the CRA of July 27, 2026 (section on reporting obligations). The guidance is not legally binding.
What this means for machinery and plant manufacturers
For manufacturers of machinery, plants, and equipment, this rule has far-reaching consequences. The entire installed base of connected products, from the controller and the gateway to the software component, has been subject to the reporting obligation since September 2026. This applies to all of them that are products with digital elements within the meaning of the CRA.
This requires manufacturers to know which of their legacy products are affected, which software components these products contain, and through which channels they learn about actively exploited vulnerabilities. The 24-hour deadline for the early warning notification leaves no room for ad hoc processes. If you do not yet have established processes for detecting and reporting vulnerabilities, you cannot meet the deadlines.
How this relates to NIS2
The CRA reporting obligations supplement the existing reporting obligations under the NIS2 Directive but do not replace them. NIS2 addresses the organizational cybersecurity of operators of critical infrastructure. Article 14 of the CRA sets a product-related reporting obligation for manufacturers. A company can fall under both acts at the same time: as an operator under NIS2 and as a manufacturer under the CRA. The reporting obligations are not identical, and each requires its own processes.
Where this leaves manufacturers
The CRA reporting obligations are the first binding operational requirement of the Cyber Resilience Act. They have applied since September 11, 2026, including for products already on the market. If you prepare only for the December 2027 deadline, you overlook an obligation that already applies and affects your entire existing product portfolio.
If you make connected products with digital elements, you are almost certainly affected. The open questions are how you learn about an actively exploited vulnerability in a legacy product at all, and who then triggers the notification.
Your processes have had to be in place since September 11, 2026
The templates describe vulnerability detection and the reporting path for your installed base: who assesses an incoming report, who decides, and who submits the early warning notification within 24 hours. You fill in your roles and contact channels.
