Starting today, September 11, 2026, Article 14 of the European Union’s Cyber Resilience Act (CRA) officially takes effect, forcing software and hardware vendors placing products on the European market to report actively exploited vulnerabilities and severe security incidents directly to the European Union Agency for Cybersecurity (ENISA) under strict statutory deadlines.
The Scope of the Mandate: From Consumer Hardware to Enterprise Infrastructure
The regulatory net cast by the European Commission is wide, sweeping up both new devices and legacy hardware already sitting on retail shelves or enterprise racks. Manufacturers of smart home appliances, smart locks, security cameras, baby monitors, smart toys, smartwatches, and wearables face immediate compliance obligations. The mandate doesn’t stop at consumer gadgets. Critical networking gear and security software—including routers, modems, firewalls, virtual private network (VPN) gateways, operating systems, web browsers, antivirus engines, and password managers—are fully bound by the new rules.
To streamline these disclosures, the European Union has activated the Single Reporting Platform (SRA). Manufacturers cannot simply email local authorities or patch silently in the dead of night. Every report submitted through the SRA flows simultaneously to ENISA and the national Computer Security Incident Response Team (CSIRT) of the relevant member state. In Italy, for instance, incoming telemetry hits the CSIRT managed by the National Cybersecurity Agency (ACN).
The Strict Three-Tier Reporting Timeline
When a zero-day exploit lands in the wild or a critical infrastructure breach occurs, vendors lose the luxury of quiet triage. The regulation imposes an unforgiving triphasic countdown starting the exact moment an entity confirms an active exploitation or severe incident:
- Initial Warning: Must be filed within 24 hours, alerting authorities to the existence of the actively exploited vulnerability or severe incident.
- Full Vulnerability Notification: Due within 72 hours, supplying generalized technical context and an initial risk assessment.
- Final Remediation Report: Due within 14 days of releasing a corrective security patch for vulnerabilities, or within one month of the 72-hour notification for severe incidents without an immediate software fix.
Failing to adhere to these windows carries severe financial consequences. Under the enforcement framework of the Cyber Resilience Act, non-compliant vendors face administrative fines reaching up to 15 million euros, or 2.5 percent of their total worldwide annual turnover from the preceding fiscal year, whichever figure is higher.
Preparing for the Open-Source Extension and Regulatory Burden
While commercial vendors bear the brunt of today’s enforcement kickoff, the regulatory scope expands further down the road. The mandatory reporting requirements will formally extend to open-source software projects starting December 11, 2027.
Earlier in July, the European Commission published official compliance guidelines designed to help manufacturers, independent developers, and corporate legal teams navigate the complex mandates of the CRA.
While the platform currently restricts submissions to mandatory disclosures, the European Commission plans to introduce voluntary reporting channels in future updates, allowing security researchers and smaller developers to share threat intel before an active exploit turns into a systemic crisis.
