EU Cyber Resilience Act demands 24/7 incident reporting readiness

Written by AI from the linked story. Not reviewed by an editor. How this works

The EU Cyber Resilience Act (CRA) introduced mandatory 24-hour early warning reporting for actively exploited vulnerabilities, effective September 2026, with no exemptions for weekends or holidays. Many manufacturers are unprepared because they lack both the operational processes to detect 'awareness' of exploitation in real time and designated personnel available around the clock to file reports. Additionally, maintaining a version register for every product still in use—even discontinued ones—adds a significant ongoing inventory burden that most companies have not planned for. Non-compliance risks fines of up to €15 million or 2.5% of global turnover, making this a material business risk, not just a procedural one. Organizations that treat regulatory deadlines as a future problem rather than a present operational requirement will find themselves exposed when an incident occurs on a Saturday night.

Tactical Insight

Immediate actions

Designate a named individual and a qualified backup with authority and training to file CRA early warning reports at any hour, including weekends and public holidays
Define and document internally what constitutes 'awareness' of an actively exploited vulnerability to start the 24-hour reporting clock consistently
Audit your product portfolio now to build and validate the required register of every product version still in active use, including end-of-sale items

Long-term improvements

Integrate CRA reporting obligations into your incident response plan with explicit runbooks, escalation paths, and pre-drafted report templates
Establish continuous monitoring feeds (threat intelligence, vendor advisories, CVE streams) so exploitation awareness is detected automatically rather than discovered reactively
Conduct tabletop exercises simulating a Friday-evening zero-day disclosure to test whether on-call staff can meet the 24-hour deadline end-to-end

Detection & compliance measures

Implement a vulnerability tracking system that timestamps when each potential issue enters the queue, creating an auditable record of when 'awareness' began
Schedule quarterly reviews of the product version register to capture newly deprecated versions and remove products fully out of scope
Align CRA reporting workflows with existing GDPR/NIS2 notification procedures to avoid duplicated effort and conflicting timelines