If your product connects to something, the CRA is talking to you

What the Cyber Resilience Act is

The Cyber Resilience Act is Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024, on horizontal cybersecurity requirements for products with digital elements. It was published in the Official Journal and entered into force on 10 December 2024. As a regulation it is directly applicable, without national transposition.

Its aim is twofold: to raise the baseline security of connected products throughout their lifecycle, and to give buyers clearer information to make secure choices. It introduces essential cybersecurity requirements, obligations to handle vulnerabilities, and — the part that bites first — duties to report exploited vulnerabilities and severe incidents to the authorities.

Who it applies to

It applies to economic operators that make products with digital elements available on the EU market — manufacturers first of all, and then importers and distributors. A product with digital elements is any hardware or software whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network.

Products already governed by specific sectoral rules — such as medical devices, motor vehicles, civil aviation and marine equipment — and genuinely non-commercial open source are outside its scope.

The timeline that matters

The regulation applies in stages. The reporting obligations arrive well before the product requirements — so a company can already be exposed to sanctions for a missed report long before it must show product conformity.

• 10 December 2024 The regulation enters into force.
• 11 September 2026 The reporting obligations of Art. 14 start to apply. 11 days to go
• 11 December 2027 Essential requirements, technical documentation and CE marking apply.

The reporting obligations (Art. 14)

Article 14 requires the manufacturer to notify — simultaneously the coordinating CSIRT and ENISA — any actively exploited vulnerability contained in the product, and any severe incident having an impact on its security. Reporting runs through the single reporting platform. Each event follows a three-step chain, and the final deadline differs by type of event.

24h · Early warning

Within 24 hours of becoming aware, an early warning to the CSIRT and ENISA.

72h · Notification

Within 72 hours, a fuller notification of the vulnerability or the incident.

14d / 1m · Final report

For an exploited vulnerability, within 14 days of a corrective or mitigating measure becoming available; for a severe incident, within one month of the incident notification.

Two related duties

After notifying the authorities, the manufacturer must inform the users of the product about the incident or vulnerability without undue delay and, where appropriate, about the mitigation measures.

Coordinated disclosure (Art. 13)

Manufacturers must handle vulnerabilities throughout the support period, adopt a coordinated vulnerability disclosure policy, and — where a vulnerability sits in a third-party or open-source component — report it to the maintainer and cooperate. This is impossible without an up-to-date bill of materials.

The actors: ENISA and the CSIRT

The ENISA single reporting platform

ENISA — the EU Agency for Cybersecurity — establishes and operates a single reporting platform that receives the notifications required by Art. 14 and routes them to the relevant national authorities.

ENISA · official website

The coordinating CSIRT

Each Member State designates a CSIRT — the computer security incident response team from the NIS2 framework — as coordinator for the manufacturer’s notifications. In Italy that role sits with CSIRT Italia within the national cybersecurity agency (ACN).