Cyber Resilience Act Reporting Is Now Live: What Small Makers Must Do

On 11 September 2026, the first binding part of the EU's Cyber Resilience Act started to apply. From that date, manufacturers of connected hardware and software must report actively exploited vulnerabilities and severe security incidents through a new EU channel, under tight deadlines set out by the European Commission. For many small software and device companies, the Cyber Resilience Act reporting duty is the first time EU product law asks them to act within hours rather than months.

What Changed With Cyber Resilience Act Reporting

The Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force on 10 December 2024, and most of its product requirements only apply from 11 December 2027, according to the Commission’s overview of the regulation. The reporting obligations in Article 14 were deliberately brought forward. Since 11 September 2026, a manufacturer that becomes aware of an actively exploited vulnerability in one of its products, or a severe incident affecting the security of that product, must notify it.

The timeline is strict. Under Article 14 of the regulation, an early warning is due within 24 hours of becoming aware of the issue, a fuller notification within 72 hours, and a final report no later than 14 days after a fix or mitigation is available for vulnerabilities, or within one month for severe incidents. Reports go through ENISA’s Single Reporting Platform, which went live on 11 September 2026. The notification reaches the national CSIRT acting as coordinator in the member state where the manufacturer has its main establishment, with ENISA informed at the same time. For a company headquartered in Denmark, that means the Danish coordinating CSIRT.

Two details are easy to miss. First, as Hogan Lovells Cadwalader notes, the reporting duty also covers products placed on the EU market before the CRA applies in full, and it continues after a product’s support period has ended. Second, manufacturers must also inform affected users about an actively exploited vulnerability or severe incident and, where appropriate, all users.

Why It Matters for a Small Business

The CRA covers “products with digital elements”, a broad category the Commission illustrates with examples such as baby monitors, smart watches, apps and computer programs. A Danish startup that sells a connected device, a desktop or mobile app, or software that customers install can be a manufacturer in the legal sense, regardless of size. Whether a specific product, component or cloud element falls inside the scope is not always obvious, which is why the Commission published new guidance on 27 July 2026 covering scope, substantial modification, support periods, risk assessment and reporting, with what it describes as particular attention to microenterprises and SMEs.

The penalty framework is significant. Article 64(2) allows administrative fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaches of the essential requirements and of the obligations in Articles 13 and 14. There is some relief for the smallest firms: according to Tech Times and ISMS Copilot, Article 64(10)(a) means microenterprises and small enterprises cannot be fined for missing the 24-hour early warning deadline. The obligation to report still applies to them, and that relief does not extend to the later notification and final report.

In practice, the hardest part for a small team is rarely the form itself. It is knowing, at short notice, that a vulnerability is being actively exploited, who in the company decides that the clock has started, and who has access to the reporting platform when it happens on a Friday evening.

Practical Next Steps

Start by mapping your products. List what you have placed on the EU market, including older versions still in use, and make a first, documented assessment of which items are likely to be products with digital elements. Use the Commission’s guidance as the reference point, and get legal advice for your own situation where the answer is unclear.

Next, decide who owns the 24-hour clock. Name a responsible person and a deputy, agree how a report of possible active exploitation reaches them, and set up access to the Single Reporting Platform in advance. Prepare short templates for the early warning, the 72-hour notification and the user communication, so that nobody is drafting from scratch under pressure.

Then look at how vulnerabilities reach you. A published contact point for security researchers, monitoring of the third-party and open-source components your product depends on, and a clear internal route from support tickets to the engineering team all shorten the time between an issue appearing and the company becoming aware of it. Add notification expectations to contracts with key suppliers, so that a flaw in a component they deliver does not reach you weeks late.

Finally, treat the reporting duty as a rehearsal for December 2027, when the CRA’s security-by-design, documentation and conformity requirements apply in full. The Commission’s SME page for the CRA points to support through the Digital Europe Programme and to the possibility of national training, awareness activities and regulatory sandboxes for smaller manufacturers. These are worth following as they become available in Denmark.

Brenvard's perspective

For Brenvard, the CRA has two sides. We build websites, web applications and apps, so we need to be clear, project by project, about who is the manufacturer under the CRA and who handles vulnerabilities once a product is in use. That means agreeing responsibilities, support periods and reporting contacts in writing at the start of development work, not after something goes wrong. The regulation adds steps to our delivery process and to every product team we support, and it may make some small projects more expensive. The gain is that security-by-design and clear incident routines become part of the brief from day one, which tends to produce better software and fewer surprises for everyone involved.

A Measured Response

The 11 September 2026 milestone does not require a large compliance programme overnight, but it does require a working process that can act within a day. Small manufacturers that clarify their product scope, assign responsibility and test their reporting route now will be in a far better position when the full regulation applies. Brenvard helps startups and smaller businesses put that kind of process in place as part of its work on cybersecurity and data protection, alongside the legal and technical advice each company needs for its own products.

Sources

European Commission – Cyber Resilience Act: Reporting obligations (accessed 1 October 2026)
European Commission – Cyber Resilience Act (accessed 1 October 2026)
European Commission – Commission publishes new guidance to support businesses' implementation of the Cyber Resilience Act (27 July 2026)
European Commission – Cyber Resilience Act: SMEs (updated 31 July 2026)
EUR-Lex – Regulation (EU) 2024/2847 (Cyber Resilience Act)
Hogan Lovells Cadwalader – EU Cyber Resilience Act: Vulnerability and incident reporting obligations now apply and ENISA’s Single Reporting Platform is live (11 September 2026)
Tech Times – EU Cyber Resilience Act Goes Live: Manufacturers Now Face 24-Hour Deadline to Report Exploited Flaws (11 September 2026)
ISMS Copilot – Cyber Resilience Act: what applies from 11 September 2026 (11 September 2026)