What does the CRA require when a vulnerability is exploited?

Article 14 of the Cyber Resilience Act requires manufacturers of products with digital elements to notify actively exploited vulnerabilities in their products, and severe incidents that affect the security of those products, in several stages. For the stages, their deadlines and who receives the notifications, see Regulation (EU) 2024/2847, Article 14. These reporting duties apply from 11 September 2026. They concern manufacturers, not companies that only use the products, although a user's own incident may still have to be reported under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. or the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)..

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics