It’s LIVE: The Cyber Resilience Act Reporting Is Mandatory as of Today - 11 September 2026

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow.

The question every manufacturer should be able to answer today is simple: if a reportable event occurs tonight, can your organisation report it tomorrow?

This alert succeeds our more detailed earlier alert and sets out the practical status quo: where, to whom, by when, and on what basis, to report – and what manufacturers can still do today to make sure they are ready.

1. Where: The SRP Is Now the Gateway

All notifications must be submitted through the SRP, an online platform operated by the EU’s Cyber Agency (“ENISA”) and which just went live today.

Before You Report: know your competent CSIRT (“CDaC”), ARs and access:

• First, determine your main establishment. The relevant CDaC is the CSIRT of the EU Member State where the manufacturer's main establishment is located, which is where cybersecurity decisions for the relevant products are predominantly taken. There is currently no published EU Commission or ENISA guidance that provides a list of specific indicators or factors for determining where cybersecurity decisions are “predominantly taken”.  While the CRA does not cross-reference another legal instrument for the main establishment test, the formulation is conceptually analogous to the one under the GDPR or the NIS2 Directive – which respectively provide that the main establishment is the place where personal data processing and cybersecurity risk-management measures are taken. Therefore, in the case of the CRA, which is a product cyber security law, the test will revolve around where product cybersecurity decisions are taken. For most companies, this would likely be an engineering site rather than a corporate headquarters.

Importantly, selecting the wrong CDaC risks invalidation and resubmission. The analysis should be documented and readily accessible before an incident occurs. The CDaC should be embedded into your incident response and vulnerability management processes, with clear escalation procedures.

The list of national CSIRTs designed as coordinators was published by ENISA and is available here.

• Second, appoint your ARs and implement or update incident and vulnerability response procedures. The AR operates the SRP on the manufacturer's behalf and carries out the actual mechanism of reporting. This is an internal-facing role distinct from the Article 18 authorised representative who has external-facing responsibilities, including interacting with Market Surveillance Authorities (“MSAs”) and retaining the technical documentation required by the CRA. Manufacturers should appoint a primary AR and backups with out-of-hours cover. The platform allows one Primary AR and up to 20 Secondary ARs. As this time, ENISA does not recommend registering as a manufacturer on the SRP prior to experiencing a reportable incident or vulnerability.

A dedicated AR User Manual has been published, providing step-by-step guidance on AR registration, login, notification submission, and AR association management. In addition, more detailed guidance was published on the logistics of filing a report. ARs should consult this before their first access to the platform.

• Third, get EU Login and MFA ready. Your ARs access the SRP via individual EU Login accounts through Multi-Factor Authentication (“MFA”). Get authentication arrangements in place now.

Guidance was published on the logistics of AR registration.

• Fourth, train your staff. Your ARs and other relevant stakeholders involved in incident response (Legal, Compliance, IT, Product Development) should be trained on your incident and vulnerability response protocols – and ARs in particular should receive training on how to report. This should be done pre-incident since timelines during a live incident response event are tight.

FAQs on the SRP generally are also published and continuously updated.

2. Who: One Report, One Platform, Multiple Authorities

Notifications are submitted through the SRP to the CDaC of the EU Member State where the manufacturer's main establishment is based, and made available simultaneously to ENISA. The receiving CDaC can then disseminate the notification to other relevant CSIRTs where the product has been made available. The national EU Member State MSAs, responsible for CRA enforcement, may also receive information through this structure. Following a notification, the CDaC may request further information or an intermediate report from the manufacturer. The competent MSA may separately request information to assess compliance with the reporting obligations and, where appropriate, take enforcement action.

3. When: Notification Deadlines

Article 14 CRA establishes a staged timeline across two categories: serious incidents and actively exploited vulnerabilities.

The reporting sequence is deliberately staged:

• Within 24 hours: early warning.
• Within 72 hours: more detailed vulnerability or incident notification, including information available at that point.
• Final report: for an actively exploited vulnerability, no later than 14 days after a corrective or mitigating measure becomes available; for a serious incident, within one month after the 72-hour notification.

The 24-hour notification is not the final investigations report. The CRA expressly allows information to be provided progressively. The organisation therefore needs a process for making an early call on reporting whilst the facts and forensics are still developing. The CDaC can also request an additional interim report prior to the final report to ensure that all information related to the reportable vulnerability or incident is documented and reported on more regularly.

4. What: Reporting Triggers – A Brief Reminder

As discussed in our earlier alert, Article 14 CRA covers two categories of reportable events: actively exploited vulnerabilities, vulnerabilities being actively exploited in the wild, and serious incidents, those having, or potentially having, a significant impact on the security of the product or its users.

ENISA has also disclosed a CRA Glossary, which contains an overview of the types of information that must be included in a report.

5. Preparation: Policies, Procedures, and Governance

Beyond SRP logistics and preparation, the following  preparatory steps are essential:

• Governance and incident response ownership. Designate named owners across product security, legal, compliance, and communications, with clear decision rights on who classifies, confirms, and triggers a CRA notification.
• Update your Incident Response Plan (“IRP”) and vulnerability management policies to reflect CRA-specific triggers and timelines alongside NIS2, GDPR, and any other applicable requirements.
• Prepare notification templates in advance. Prepare a notification template in advance while  maintaining an internal incident log capturing the awareness timestamp, classification decision, and submission record.
• Vulnerability monitoring and scanning. Continuous monitoring against vulnerability databases, automated common vulnerabilities and exposures (“CVE”) alerting, and a triage system based on exploitability are prerequisites for meeting the 24-hour window.
• Supply-chain flow-down: Ensure that your customers and third-party suppliers up the chain (especially suppliers of connected components embedded into your products) are contractually required to notify you of any vulnerabilities or incidents they have identified.

Enforcement Forecast

Enforcement will build over time, with early regulatory action likely to provide a clearer picture of how the CRA will be applied in practice. Large technology, machinery, and software companies are natural candidates for early attention, and enforcement posture will vary by Member State, reinforcing the strategic importance of CDaC selection. Documented good-faith preparation will matter.

How We Can Help

Crowell & Moring’s team consists of cybersecurity, data privacy, product safety, litigation and contract lawyers and leverages this cross-disciplinary bench to advise both hardware and software manufacturers on CRA compliance across sectors including consumer products, industrial technology, semiconductors, health care technology, and financial services infrastructure.

We assist clients with, among other things:

• SRP registration support, including AR designation and EU Login configuration
• Article 14 notification workflow design, escalation protocol development, and template preparation
• Incident and vulnerability response, managing parallel obligations under CRA, NIS 2, and GDPR in a single, coherent workflow
• Supply chain contract review
• Product liability risk and scoping assessments, incl. evaluating exposure arising from in-scope products and reported vulnerabilities

For further information, please contact Lauren Cuyvers, Basma Safir or Thanasis Christou.

*Note: this client alert reflects the law and guidance as of 11 September 2026. Regulatory guidance is continuously updated. Please reach out to a member of our team to receive the latest updates.