active

EU Cyber Resilience Act reporting begins

Manufacturers of products with digital elements sold in the EU must now report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. Full CRA obligations follow in December 2027.

Tracking since 10 Dec 2024Last updated 11 Sept 2026

Our coverage

EU regulation

EU Cyber Resilience Act reporting has started: what software vendors must do now

Since 11 September 2026, anyone placing software or connected products on the EU market must report exploited vulnerabilities and severe incidents within 24 hours. Here is the runbook.

QULDEX Editorial Team29 Sept 20262 min read