Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products. The first deadline is 24 hours.
An actively exploited vulnerability is a vulnerability for which there is reliable evidence that it has been exploited in the product. A severe incident is an incident that affects the security of the product, for example by compromising its data or functions.
The obligation applies to every product with digital elements on the EU market, including products placed on the market before December 2027. It is the first part of the CRA that is already in force.
Within 24 hours
After you become aware of it, including the member states where the product is made available, if known.
Within 72 hours
General information about the product, the exploit and the vulnerability, and the measures taken or recommended.
Within 14 days
At the latest 14 days after a corrective or mitigating measure is available: description, severity, impact and the security update.
Within 24 hours
After you become aware of it, including whether it is suspected to be caused by unlawful or malicious acts.
Within 72 hours
General information about the nature of the incident, an initial assessment and the measures taken or recommended.
Within one month
At the latest one month after the notification: description, severity, impact, threat type and mitigation measures.
A 24 hour deadline only works if the decisions are prepared before the first case.
1
Sources that tell you when a component in your products is exploited, from advisories to your own support channels.
2
Criteria for when a finding counts as actively exploited and must be reported.
3
Named people who decide and report, with cover for weekends and holidays.
4
Registration and accounts for the single reporting platform, tested before they are needed.
5
Prepared texts for the early warning, notification, final report and user information.
6
Reporting connected to analysis, fixes and updates, as Annex I Part II requires.
As of October 2026. These guides explain the regulation in plain language and are not legal advice.
We set up the reporting process with your team and connect it to monitoring and fixes. AITIGRITY Vulnerability management supports the reports.
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.
