CRA Reporting Is Live: What Manufacturers, Vendors, and Distributors Need to Know
EU Cyber Resilience Act Article 14 reporting for product vulnerabilities is now in force.
As of September 11, 2026, Article 14 of the EU Cyber Resilience Act (CRA) requires manufacturers, importers, and distributors of products with digital elements sold into the EU to notify ENISA or their national CSIRT within 24 hours of learning about actively exploited vulnerabilities. Mitigation reports are due in 72 hours, and full analyses within two weeks. This initial milestone is part of broader secure development obligations set to arrive in December 2027, with potential penalties for non-compliance reaching up to 2.5% of global turnover or 15 million euros.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Black Duck?
Get an email when a new story names Black Duck, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe EU Cyber Resilience Act (CRA) Article 14 introduces strict, time-bound disclosure obligations for manufacturers, importers, and distributors of products with digital elements — requiring notification to ENISA or a national CSIRT within 24 hours of discovering an actively exploited vulnerability. Many organizations in the hardware and software supply chain are unprepared for these tight deadlines, lacking the internal processes, tooling, or governance structures to detect, triage, and report vulnerabilities at this speed. Failure to comply carries severe financial penalties of up to 2.5% of global annual turnover or €15 million, making this a board-level risk. This regulation signals a fundamental shift: vulnerability disclosure is no longer voluntary or industry-led — it is a legal obligation with teeth, and organizations that treat security as an afterthought will face significant legal and reputational exposure.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.