Brussels: A new reporting choke point opens for European software and hardware vendors on 11 September 2026, when the Cyber Resilience Act’s incident notification rules switch on a full fifteen months before the regulation’s main obligations apply. The early phase-in is deliberate. Brussels wants a working pipeline of vulnerability data flowing through national Computer Security Incident Response Teams and ENISA before the conformity assessment grid solidifies in late 2027, and the Commission has structured the legal text to test that pipeline first.
The mechanics are tight. Once a manufacturer becomes aware that a vulnerability in a product with digital elements is being actively exploited, an early warning has to reach the relevant national CSIRT within 24 hours through the Single Reporting Platform, the dedicated CRA pipe that runs alongside but separately from the NIS2 incident channel. A more substantive notification follows at 72 hours, and a final report is due within fourteen days after a corrective measure becomes available. Severe incidents that affect the security of a product also fall under the same clock, with the final report extending to one month.
Two design choices shape the workload. First, the platform forwards reports simultaneously to ENISA, removing the staggered escalation that NIS2 still permits in practice. Second, the obligation reaches back to legacy products. Anything placed on the EU market before 11 December 2027 is in scope from the moment the reporting rules apply, which means most of the installed base of consumer routers, industrial controllers, building automation gear and connected appliances becomes reportable in September. The implementing rules adopted earlier in 2026 confirm that only the manufacturer at the point of placing on the market carries the duty, but the population is wide.
CSIRT capacity is the next variable. National teams have been adding head count through the NIS2 build, but the CRA model is different in tempo. Vulnerabilities surface continuously and often in clusters tied to widely deployed components, which produces sharp spikes in reporting rather than the steadier breach flow that NIS2 captures. The Commission’s own impact assessment had assumed a few thousand reports a year across the bloc once the regime fully matures. Security researchers tracking exploit traffic on EU-sold products think the early traffic will run well above that floor because manufacturers will report defensively to avoid enforcement risk.
The compliance picture also splits by sector. Pure software vendors and cloud-delivered tools are mostly out of scope under the final text, which limits the rule to products with digital elements placed on the market. But software-as-a-medical-device, automotive electronic control units, programmable logic controllers in factories, smart meters and a growing list of consumer connected goods sit squarely inside. Several large continental manufacturers have already rolled out internal vulnerability handling policies that mirror the CRA’s twelve-step requirements set out in Annex I, including coordinated disclosure pathways and security update guarantees that have to last the expected product lifetime.
A second deadline runs in parallel. From 11 June 2026, the chapter on notification of conformity assessment bodies starts to apply, opening the queue for the notified-body network that will sign off on the most critical product classes once 11 December 2027 arrives. National accreditation bodies in Germany, France, Italy, the Netherlands and Sweden have begun publishing scoping criteria for prospective notified bodies, and ENISA has flagged a likely capacity squeeze on Class II important and critical products if accreditation does not move faster.
The data Brussels collects during the fifteen-month window before full application will matter for what comes next. The Commission has committed to publish an evaluation of the platform’s first reporting cycle, with anonymised aggregates feeding into the broader cybersecurity threat landscape used by ENISA and the EU CyCLONe network. Member State CSIRT leads in the EU CSIRTs Network have asked for a common taxonomy so that the same exploit affecting products sold in twelve countries does not generate twelve incompatible records, and that taxonomy work is now the gating item before the platform’s go-live.
What manufacturers are watching is enforcement texture. The CRA caps fines at 15 million euro or 2.5 percent of global turnover for the most serious breaches, with reporting failures sitting one band lower. National market surveillance authorities have not yet harmonised enforcement priorities, and a first wave of dual-track investigations under both CRA reporting and NIS2 incident rules is widely expected by mid-2027.
