From 11 September, the vulnerability reporting obligation of the EU Cyber Resilience Act (CRA) takes formal effect. Many companies are still waiting for the full application date of 11 December 2027 and assume they have plenty of time. But this obligation will not wait — it arrives a full 15 months before full application.

In other words: from next week, any manufacturer selling connected products (products with digital elements, PDE) in the EU market must, once an exploited vulnerability is discovered in a product or a severe security incident occurs, report it on the EU timetable to the ENISA Single Reporting Platform (SRP).

How fast is the CRA reporting clock?

· Early warning within 24 hours;

· Detailed incident notification within 72 hours;

· Final report within 30 days, covering root cause analysis and remediation measures.

Once a product is affected, the countdown is measured in hours. Building a team and defining processes at that point is simply too late.

Scope of impact

Smart cameras, smart door locks, routers, NAS devices, charging piles, industrial gateways, PLCs, HMIs, energy storage systems, operating systems, apps, cloud platform clients — almost every product with digital elements is covered.

The current reality, however, is that the great majority of companies have no security@ intake channel, no vulnerability handling process and no coordinated vulnerability disclosure (CVD) mechanism. These are not nice-to-haves; they are the baseline after 11 September.

Action items

With only seven days left, work must start immediately:

(1) Establish a PSIRT team, with clear roles, escalation paths and emergency procedures;

(2) Publish a CVD policy setting out how vulnerabilities can be submitted, response times and handling procedures;

(3) Set up security contact channels: a security@ mailbox, an official security page and named security contacts;

(4) Build a closed-loop vulnerability management process: intake, assessment, CVSS rating, remediation, patching, disclosure and reporting;

(5) Carry out a CRA gap analysis against Annex I, secure development lifecycle (SDL), SBOM, and vulnerability and update mechanisms.

NTEK capability

NTEK Information Security Laboratory provides one-stop support for clearing the CRA's first hurdle:

· CRA gap analysis;

· PSIRT system development;

· CVD policy development;

· Vulnerability management process development;

· CRA technical documentation coaching;

· Product cybersecurity testing and conformity verification.

The countdown has begun and the time left is measured in days. Act now and 11 September becomes manageable.

Click for more on EU CRA regulations:

The EU CRA is about to take effect: the new cybersecurity threshold exporters to Europe must address

Full analysis of CRA product scope: is your product regulated by the EU Cyber Resilience Act?

Only three months until the CRA takes effect: vulnerability reporting obligations apply from 11 September 2026