Services: Electrical testing and certification, environmental or chemical testing

language
- English
- 中文

400-9269-886

NEWS CENTER

Industry News

Company News

Knowledge

The EU's Cyberresilience Act imposes reporting obligations on CRA vulnerabilities and security incidents, which will officially come into effect on September 11, 2026

Time：

2026-09-11

On September 11, 2026, the obligation to report vulnerabilities and security incidents under Article 14 of the EU's Cyberresilience Act (CRA) will officially come into effect. Once manufacturers discover vulnerabilities or serious security incidents that have been actively exploited in their products, they must report them uniformly through the EU's Single Reporting Platform (SRP).

On September 11, 2026, the vulnerability and security incident reporting obligations under Article 14 of the EU Cyber Resilience Act (CRA) will officially come into effect, marking the first mandatory compliance milestone since the CRA entered into force on December 10, 2024. All digital element products sold in the EU market must meet the CRA compliance requirements.

Key Time Nodes for CRA Implementation

December 10, 2024: The CRA officially enters into force.

September 11, 2026: The reporting obligations for manufacturers regarding vulnerabilities and security incidents under Article 14 of the CRA will be enforced. Once a manufacturer becomes aware of an actively exploited vulnerability in a product, or a serious incident affecting product security, it shall initiate the reporting procedure in accordance with the CRA.

December 11, 2027, all core obligations of the CRA will be fully implemented. New products placed on the market within the scope of the CRA must meet the security requirements throughout their entire lifecycle, complete a conformity assessment, and affix the CE mark before entering the EU market.

CRA applicable product scope

The EU Cyber Resilience Act (CRA) is a mandatory cybersecurity regulation for digital products in the EU market, covering categories such as the Internet of Things (IoT), smart homes, consumer electronics, industrial control, and network communication equipment, having a profound impact on manufacturing enterprises exporting to the EU.

The CRA applies to all products with digital elements that can connect directly or indirectly to a device or network, including hardware (such as smart appliances, mobile phones, routers, etc.), software (such as operating systems, applications, etc.), and their remote data processing solutions.

Explicit exemptions: medical devices (already covered by MDR/IVDR), motor vehicles, aviation and maritime equipment, purely non-commercial open-source software, and purely website and cloud applications unrelated to PDE.

Key Points of Manufacturer's Reporting Obligations under Article 14 of the CRA

In accordance with Article 14 of the CRA, once a manufacturer discovers a product with an actively exploited vulnerability or a serious security incident, it must report it uniformly through the EU Single Reporting Platform (SRP), and simultaneously notify the European Union Agency for Cybersecurity (ENISA) and the Computer Security Incident Response Team (CSIRT).

Reporting Requirements for Actively Exploited Vulnerabilities

Phase	Time limit	Main requirements
Early warning	Within 24 hours	Submit a report on the basic situation of the vulnerability, the affected products, and the preliminary scope of impact.
Vulnerability Notification	Within 72 hours	Submit a complete notification, providing detailed information such as vulnerability details, exploitation methods, mitigation measures taken, and user protection guidelines.
Final Report	Within 14 days after the completion of vulnerability repair	Submit the final report, including a complete description of the vulnerability, severity, scope of impact, and details of remedial measures.

Reporting Requirements for Serious Security Incidents

Phase	Time limit	Main requirements
Early warning	Within 24 hours	Report the basic situation of the incident, whether it is suspected of malicious attacks, the initial scope of impact, and the mitigation or corrective measures taken.
Vulnerability Notification	Within 72 hours	Submit a complete notification, providing detailed information such as the nature of the event, preliminary impact assessment, and measures taken for disposal.
Final Report	Within 14 days after the completion of vulnerability repair	Includes detailed description of the event, root cause analysis, implemented and ongoing mitigation measures.

来源：CVC

CRA Compliance Recommendations

Starting from September 11, 2026, manufacturers must proactively report confirmed product security vulnerabilities and incidents through the EU unified vulnerability reporting platform (CRA early obligation). Starting from December 11, 2027, the EU's Cyberresilience Act (CRA) will be fully enforced. Devices with digital elements that do not meet CRA requirements will be prohibited from being sold in the EU market.

As a professional third-party testing and certification service organization, Jiayu Testing has qualifications such as CMA, CNAS, CBTL, CCC, and has obtained laboratory accreditation from multiple authoritative certification agencies at home and abroad. It is equipped with advanced instruments and equipment, has a skilled professional technical team, rich industry service experience, and strong testing technology capabilities. It is proficient in various regulatory standards and provides customers with EU CRA compliance solutions. Welcome to contact us 400-9269-886！