Cyber Reality: Report Vulnerabilities Within 24 Hours – or Risk Multi-Million-Euro Fines

Cyber Reality: Report Vulnerabilities Within 24 Hours – or Risk Multi-Million-Euro Fines

The implementation of the EU Cyber Resilience Act (CRA) is gaining momentum. As of 11 September 2026, the reporting obligations under Article 14 have become applicable. Manufacturers must report actively exploited vulnerabilities in products with digital elements that they become aware of, as well as severe incidents affecting the security of those products.

Reports must be submitted through the Single Reporting Platform administered by ENISA. The information is then transmitted to the designated CSIRT acting as coordinator and to ENISA.

The reporting deadlines are tight:

– Within 24 hours of becoming aware of an actively exploited vulnerability, an early warning must be submitted.
– Within 72 hours of becoming aware of the vulnerability, a more detailed notification must follow. It must include general information about the vulnerability and, where available, information concerning its exploitation.
– No later than 14 days after a corrective or mitigating measure becomes available, a final report must be submitted.

Non-compliance can be extremely costly. Infringements of the obligations laid down in Articles 13 and 14 may result in administrative fines of up to EUR 15 million or, for an undertaking, up to 2.5% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

There is, however, an important exception for microenterprises and small enterprises: they are not subject to administrative fines for failing to comply with the 24-hour early-warning deadline. Importantly, this exception concerns the fine, not the reporting obligation itself. The 24-hour reporting requirement still applies.

EU Cyber Resilience Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847
Single Reporting Platform: https://portal.cra-srp.enisa.europa.eu/