Cyber Resilience Act vulnerability reporting

The Cyber Resilience Act (Regulation (EU) 2024/2847) covers products with digital elements: connected devices, apps that control them and most software sold in the EU. Most requirements apply from 11 December 2027, but the reporting obligations in Article 14 have applied since 11 September 2026.

What manufacturers must report

Actively exploited vulnerabilities and severe incidents affecting the security of their products, through ENISA's Single Reporting Platform:

• an early warning within 24 hours of becoming aware;
• a notification within 72 hours;
• a final report within 14 days after a fix is available for a vulnerability, or within one month for a severe incident.

Users must also be informed. The duty covers products already on the market, and fines for breaches can reach €15 million or 2.5% of worldwide turnover. Importers and distributors have their own checks, and a company that puts its own brand on a product becomes its manufacturer.

What we deliver

1. Scope check — which of your products have digital elements and who the manufacturer is.
2. SBOM — a software bill of materials for each product, including third-party components.
3. Intake — a public vulnerability contact and an internal triage process.
4. Playbook — who decides, who writes and who submits each notice within the deadlines, with templates.
5. On-call support — help preparing and submitting notices when something happens.

Particularly useful for brands importing connected products from manufacturers in China; support available in Mandarin Chinese (中文服务).

Work with us

List your connected products through the contact page or WhatsApp.