What happened
ENISA launched the first operational version of the CRA Single Reporting Platform on 11 September 2026, when reporting obligations for manufacturers took effect. The platform allows manufacturers to notify the relevant authorities through a single channel. The CRA’s main cybersecurity requirements apply from 11 December 2027. [1]
The European Commission’s guidance specifies an early warning within 24 hours and a full notification within 72 hours of becoming aware of a reportable event. Final reports have different deadlines: no later than 14 days after a corrective measure becomes available for actively exploited vulnerabilities, and within a month of the 72-hour notification for severe incidents. [2]
Why it matters for manufacturers
Firmware engineering and incident reporting operate on different timelines. Reproducing an issue, adapting an upstream patch, rebuilding an image, and testing the product may take longer than the initial notification window. The reporting process must accommodate incomplete information and allow updates as the investigation progresses.
Reportability requires a product-specific assessment. A CVE in a scanner report does not, by itself, establish that a vulnerability is actively exploited or that a severe incident has occurred. The assessment must consider the event, the products involved, and their configuration. [2]
Maintain a shared record of when the manufacturer became aware, which versions are affected, available mitigations, planned fixes, and completed tests. This allows engineering findings to inform subsequent notifications while the initial report proceeds on schedule.
How to coordinate reporting and remediation
- Identify who assesses reportability, maintains the timeline, and is authorized to submit notifications.
- Record affected product versions, known impact, available mitigations, and outstanding investigation questions.
- Keep notification records linked to the proposed fix, candidate firmware, and validation results as the work progresses.
The engineering takeaway
Coordinate reporting and remediation under clearly assigned responsibilities. Prepare notifications using the facts available at each deadline while engineering continues to develop and validate the fix.
Primary sources
- ENISA: The CRA Single Reporting Platform is launched11 September 2026.
- European Commission: Cyber Resilience Act reporting obligationsCovers reportable events, notification deadlines, and the Single Reporting Platform.
Sources reviewed on . The manufacturer guidance and engineering takeaway reflect Firmdura’s analysis.