Severity: Medium Guidance EU Action required
Reporting obligation for vulnerabilities and security incidents commences
Original title: CRA Meldepflicht Schwachstellen
- Published
- Source: bsi.bund.de
- Effective
- Not stated
- Deadline
- Not stated
Why it matters
From 11 September 2026, manufacturers of products with digital elements in the EU internal market must report actively exploited vulnerabilities and serious security incidents. Reports are submitted EU-wide uniformly via the Single Reporting Platform (CRA-SRP) provided by ENISA to the responsible coordinating CSIRT of each Member State and to ENISA. Manufacturers can register and submit a report within minutes, with no prior registration required, and the platform operates centrally, user-friendly and confidentially.
What changed
- Reporting obligation for actively exploited vulnerabilities enters into force: manufacturers must report security gaps that are already being exploited by attackers
- Reporting obligation for serious security incidents: manufacturers must report incidents that affect the security of their products with digital elements
- Single Reporting Platform (CRA-SRP) is officially introduced as a unified EU-wide reporting channel through which reports are submitted to the coordinating CSIRT and all affected Member States
- Jurisdiction rules for manufacturers: for manufacturers with EU head office, jurisdiction is determined by the Member State where essential cybersecurity decisions are made; for non-EU manufacturers, jurisdiction is determined by criteria such as authorized representative, importer or product availability
Who is affected
Manufacturers of products with digital elements in the EU internal market, regardless of their head office location
What to do
Manufacturers of products with digital elements must report actively exploited vulnerabilities and serious security incidents via the CRA-SRP.
AI-assisted summary of the official document; the official text prevails. Not legal advice.