Regulation · Security · DevOps
CRA reporting duty from 11 September 2026: 24 hours, 72 hours, 14 days
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities – in three stages and on a fixed clock. What this means for development and DevOps teams.
What this is about
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) sets security requirements for products with digital elements. The first duty to apply is reporting actively exploited vulnerabilities and severe incidents: it applies from 11 September 2026, well ahead of the other requirements. The clock starts when the manufacturer becomes aware of active exploitation – not when everything is clarified.
The three deadlines
| Stage | Deadline | Content |
|---|---|---|
| Early warning | 24 hours | Minimal detail, speed over completeness |
| Notification | 72 hours | Product, description, severity, impact, measures taken or planned |
| Final report | 14 days | CVE, CVSS score, root cause, remediation, disclosure status, user notification |
Reports go through ENISA’s single reporting platform, which forwards them to the national CSIRTs. Separately, affected users must be informed without undue delay. The source names a ceiling of up to €10 million or 2% of worldwide annual turnover for breaches. For details, such as the deadline for severe incidents, please read the regulation text.
Who is affected?
Manufacturers of products with digital elements are obliged. Importers and distributors do not report to ENISA themselves, but must pass vulnerability information to the manufacturer without delay. As I understand it, a pure web service (SaaS) without an accompanying product is not itself a manufacturer under the CRA; whoever ships software or devices that customers run is more likely to be. That is my reading, not an official statement – when in doubt, check it against the regulation text.
What a development team should prepare
- A named person and a process: who decides within hours whether something is “actively exploited”, and who sends the early warning?
- An overview of your dependencies: without a list of the libraries in use (an SBOM), “are we affected?” becomes a search in the dark.
- Fast, repeatable delivery of fixes: a clean CI/CD pipeline is not a luxury here but the precondition for reporting something fixed after 14 days.
- A channel to users: how do you reach your customers when an update is urgent?
This fits what I describe in the notes on zero trust for the homelab and on NIS2 for small IT companies: anyone who knows their access paths and dependencies has an advantage under both regimes.
Sources and limits
- CRA Compliance Hub: Article 14 (secondary source, as of October 2026)
- Regulation (EU) 2024/2847 in the Official Journal – the binding text
Not legal advice. I am a developer, not a lawyer. The details come from the sources listed (as of October 2026); the legal text is what counts.
Keep reading
Regulation · IT security · SMEs
NIS2 for small IT companies and freelancers: thresholds, deadlines, duties
The German NIS2 implementation act has been in force since 6 December 2025. Whether a company is directly affected depends on sector and size – but small firms feel it as suppliers too.
DevOps · CI/CD · Next.js
CI/CD for Next.js 15 on a VPS: GitHub Actions, PM2 reload and Caddy
Manual deployments were slow and error-prone. Today a git push is enough – no downtime and no PaaS.
Regulation · AI · Transparency
AI Act Article 50: what needs doing by 2 December 2026
Most of Article 50’s transparency duties have applied since 2 August 2026. For the machine-readable marking of generative AI already on the market, a transition period runs until 2 December 2026. A checklist for developers and operators.
Career · DevOps · Field report
Career change into DevOps in Germany: my plan, my evidence, my gaps
I am looking for a permanent IT job, with DevOps and platform engineering as the best fit. This is an open account of what the market offers according to the numbers, where I come from and how I make my skills verifiable.
More from practice
Find more notes, case studies and projects on the homepage.
All notes Case study MeisterMeld Case study PflegeOasis Case study Kernbohr-Expert Back to the homepage
Comments
Join the discussion: comments run on GitHub Discussions (sign in with a GitHub account). Content from GitHub/giscus is only loaded after you click. Privacy