Article 14 of the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, has applied since 11 September 2026. Anyone who offers software, apps, firmware or connected devices in the EU under their own name must report actively exploited vulnerabilities and severe incidents, with the first warning due within 24 hours. The obligation has no size exemption and also covers products that have long been running at customers' sites.
If you only use software, you are not affected; small software companies, machine builders with their own control software and retailers with a private label, however, are.
Note: This article is not legal advice. If in doubt, seek legal advice on whether your product falls under the CRA. As of 13 October 2026.
Am I a Manufacturer Under the CRA?
Under Art. 3(13), a manufacturer is anyone who develops products with digital elements, or has them developed, and markets them under their own name or trademark, "whether for payment, monetisation or free of charge". Three questions settle it:
- Do you offer a software or hardware product that connects to a device or network?
- Do you do so as part of your business activity? Free products count too.
- Does it carry your name or trademark? Importers and distributors are also considered manufacturers if they place a product on the market under their own name or trademark, or substantially modify it (Art. 21).
Typical cases are the special-purpose machine builder from the district of Recklinghausen with its own control and remote maintenance software, the agency with its own app in an app store, and the online retailer selling bought-in smart plugs under its private label.
Who Does Not Have to Report
Apart from mere users, the following are out of scope:
- pure web applications: according to the European Commission guidelines published in July 2026, which have not yet been formally adopted, a web application that users access only through a browser is not a product with digital elements,
- software for own use, because according to the Commission's FAQ it is not placed on the market,
- non-commercial open-source software,
- areas with their own legislation such as medical devices, vehicles, civil aviation and marine equipment.
The web application exception is narrower than many hope: if your web application comes with an installable app, a browser extension, an agent on customers' computers or firmware, you have a product, and the backend without which this product cannot perform one of its functions is included as "remote data processing".
Which Deadlines Run Once You Learn of a Vulnerability?
| Stage | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | within 24 hours | within 24 hours |
| Notification | within 72 hours | within 72 hours |
| Final report | no later than 14 days after a corrective or mitigating measure is available | within one month of the 72-hour notification |
The 24- and 72-hour limits are maximums; you must report without undue delay. Reports go simultaneously to the coordinating CSIRT, which in Germany is CERT-Bund at the BSI (Germany's Federal Office for Information Security), and to the EU agency ENISA, via ENISA's single reporting platform. In addition, you inform the affected users and, where necessary, tell them what they can do themselves (Art. 14(8)).
An incident is "severe" if it affects the security of the product and can endanger sensitive or important data or functions or introduce malicious code (Art. 14(5)), for example a manipulated update server; according to the BSI, a ransomware incident at the manufacturer is not automatically one.
Worked Example: Becoming Aware on a Friday at 4 p.m.
Suppose the machine builder learns from a customer on Friday, 16 October 2026, that attackers are exploiting a vulnerability in its remote maintenance software, and at 4 p.m. an initial assessment confirms it. According to the Commission's draft guidelines, the manufacturer has thereby become aware: it knows with a reasonable degree of certainty that the vulnerability is being actively exploited. Counting conservatively from 4 p.m.:
- Early warning: by Saturday, 17 October, 4 p.m.
- Notification: by Monday, 19 October, 4 p.m.
- Final report: if the update is available on Thursday, 22 October, by Thursday, 5 November
The deadlines count in hours, not working days. If you go into the weekend after the assessment, you will have missed the first deadline by Monday. Yet the early warning is the smallest part: according to the BSI, it mainly needs the report category, the manufacturer, the affected product and a meaningful title, with the rest added step by step. My advice: have this information and your country list ready, and the early warning takes minutes, even on a Saturday.
What Small Businesses Face for Violations
Violations of Art. 14 can cost up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)). With a turnover of EUR 5 million, 2.5% would be just EUR 125,000; because the higher amount applies, the range still extends to EUR 15 million. When the fine is set, however, the size of the company must be taken into account (Art. 64(5)). Two points put this into perspective:
- No fine for a missed early warning: micro and small enterprises, which under the EU definition have fewer than 10 or fewer than 50 employees and an annual turnover or balance sheet total of no more than EUR 2 million or EUR 10 million respectively, are not fined for missing the 24-hour deadline (Art. 64(10) as corrected in 2025). This does not apply to the 72-hour notification or the final report.
- Fines only from December 2027: the penalty rules are not among the parts of the Regulation that apply early (Art. 71(2)); according to the Commission's FAQ, market surveillance and enforcement apply from 11 December 2027.
Neither is a free pass: you already have to report today.
Five Building Blocks for Reporting in a Small Business
- Product and country list: Which products and versions, including older ones, are on the market in which EU countries, and how do you reach the users?
- Contact address: According to the BSI, tips may come from customers or IT security service providers, for example; make it easy for them with a security.txt file as specified in RFC 9116 at
/.well-known/security.txt; the mandatory fields areContactandExpires. The CRA does not mention the file, but from December 2027 it requires a contact address for vulnerability reports; I recommend publishing it now, example:https://yurtbay.dev/.well-known/security.txt. - Monitor sources: Regularly check your components against the KEV catalog of the US agency CISA, which collects vulnerabilities exploited in the wild; a hit is the trigger for the first assessment.
- Prepare the report: Create an EU Login account with two-factor authentication now; with it, registering on the platform takes only a few minutes according to ENISA. Reports are written in English; a template saves time. If the platform is down, the report goes to CERT-Bund by email as an exception, see the BSI guidance on the reporting platform (in German).
- Arrange a deputy: The BSI recommends reliable cover by at least two people. In a one-person business, the deputy has to come from outside; the platform allows up to 20 additional representatives with their own access per manufacturer.
CRA and NIS2: Two Laws, Two Reporting Channels
NIS2 targets the company, the CRA the product. If you have completed your NIS2 registration in the BSI portal, you have not yet done anything for the CRA, because CRA reports currently go exclusively through the EU platform. If an incident falls under both regimes, the BSI says it must be reported twice: under NIS2 via the BSI portal and under the CRA via the platform. Whether NIS2 applies to you and how registration works is covered in my NIS2 overview for small and medium-sized businesses.
What Comes in December 2027
From 11 December 2027, the rest of the Regulation applies, including security requirements for the product, CE marking, a software bill of materials (SBOM) and a support period of at least five years, unless the product is expected to be in use for a shorter time (Art. 13(8)). Legacy products are only affected if they are substantially modified; a security update that does not change the intended purpose does not count (recital 39). If you are planning a product for 2028, you should build at least five years of updates into the cost of the software project from the start.
Three Questions About the CRA Reporting Duty
Do I have to report for software I sold before 11 September 2026?
Yes. The obligation applies to all products placed on the market before 11 December 2027 (Art. 69(3)) and, according to the Commission's draft guidelines, even after support has ended. However, you do not have to retroactively report exploitation you already knew about before 11 September 2026.
Is a published exploit enough to trigger a report?
No. A vulnerability only counts as "actively exploited" if there is reliable evidence that an attacker has exploited it in a system without permission (Art. 3(42)). According to the BSI, a published exploit, proof-of-concept code or port scans are not sufficient.
Does this apply to software I develop for a single customer?
Yes, because in the BSI's view custom software also falls under the CRA, regardless of the number of units. Whether you or your customer is the manufacturer depends on whose name the software is marketed under; pure web applications are out of scope. This distinction is worth a legal check.
Do you offer software or devices under your own name and want to set up your reporting process? Then let's talk about it in a free initial consultation. For software I develop, updates and support after go-live are available on request: custom .NET software.
Note: The articles on this blog are produced with the help of AI and are editorially reviewed before publication. Editorial responsibility lies with Emre Yurtbay (see the legal notice).