EU Cyber Resilience Act Enforcement: Reporting Is Live

Most manufacturers saw nothing happen on 11 September, and that is by design. EU Cyber Resilience Act enforcement in 2026 starts with Article 14, which is reactive: the clock starts when you become aware of something, not on a calendar date. ENISA's Single Reporting Platform (SRP) went live that day at portal.cra-srp.enisa.europa.eu. A month in, here is what changed and what didn't (for the bigger picture, see the full guide).

What switched on (and what didn't)

Of the obligations on manufacturers in Regulation (EU) 2024/2847, only Article 14 applies today (the European Commission's CRA overview sets out the full timeline). It runs on two tracks:

• Actively exploited vulnerabilities: a 24-hour early warning, a 72-hour notification, then a final report within 14 days of a corrective or mitigating measure becoming available.
• Severe incidents affecting product security: the same 24-hour and 72-hour steps, then a final report within one month of the 72-hour notification.

You file through the SRP, which routes each report to your CSIRT coordinator and ENISA at the same time. Article 69(3) puts legacy products in scope too: in-scope products you placed on the EU market before 11 December 2027 are covered, not just new releases.

What has not started: the Annex I essential requirements, CE marking and conformity assessment. Those arrive on 11 December 2027.

If you only offer software as a service, with no downloadable software or device, you're likely out of CRA scope. Check whether the NIS2 reporting requirements apply instead. The exception: a cloud backend that you design and develop, or that is developed under your responsibility, and without which your hardware or software product cannot perform one of its functions, is that product's "remote data processing" (Article 3(2)) and is in scope with it.

So the obligation is real. How hard it is being policed is a separate question.

"Applies" versus "enforced": the honest status

The regulation is directly applicable, and the penalty ceiling for Article 14 breaches is set in EU law: up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.

The machinery behind that ceiling is still being built. National market surveillance authorities and penalty laws are uneven. Cullen International's July 2026 benchmark of 19 EU countries found that, at that point, only Finland and Slovakia had adopted national implementing laws. The Netherlands is a useful parallel: its NIS2 Cyberbeveiligingswet also applies now while supervision catches up.

Article 64(10) bars fines on micro and small enterprises for missing the 24-hour early-warning deadline (following the 2 July 2025 corrigendum, which expanded the derogation to include Article 64(2), the paragraph that sets fines for Article 14 reporting failures). It is the CRA's only size-based fine exemption, and it does not reach medium-sized enterprises; otherwise size is one factor authorities weigh when setting a fine (Article 64(5)). The early warning is still owed, and the 72-hour and final reports carry no relief.

Uneven enforcement doesn't remove the obligation, and the moment you became aware is reconstructable later from your own tickets, a researcher's disclosure timeline or a CSIRT advisory. If you aren't ready to file, the basics below are about a week's work for many teams, longer if you ship many products or run many intake channels. If you already know of an actively exploited vulnerability or severe incident since 11 September that you have not reported, report it now and take advice; do not wait for the setup.

Not ready? Your first week

Before Friday, confirm:

Once the process exists, the next question is what evidence feeds it.

Where a pentest fits, and where it doesn't

An authorised test finds exploitable vulnerabilities. Article 3(42) defines an actively exploited vulnerability as one with reliable evidence that a malicious actor has exploited it in a system without the owner's permission, and the CRA's recitals keep good-faith testing out of mandatory notification. So a finding from your own authorised test does not, by itself, start the Article 14 clock. There are two exceptions: testing of your product or the backend it depends on surfaces signs that someone else already got in (a web shell, unexpected accounts, tampered files), or a finding matches a vulnerability with reliable evidence of exploitation elsewhere, such as a CISA KEV entry for a component you ship. Either way, assess it at once. Under the Commission's July 2026 guidance you are aware, and the 24 hours run, once that initial assessment gives you reasonable certainty of active exploitation or of a severe incident affecting the product.

What it does give you:

• Dated, independent evidence for the Annex I Part II duty to apply "effective and regular tests and reviews". That duty arrives in December 2027, but a regular testing cadence is worth building now.
• A faster answer to the 72-hour notification's "corrective or mitigating measures" field, because you already know your exposure.

On scope: an external assessment tests the internet-facing backend your product depends on, such as APIs and update servers. It does not test firmware, binaries or update signing chains. That backend is the part CyberOrbit covers: you set the targets, our platform scopes and runs the assessment, and the report you select is independently reviewed and signed by a certified security professional. It covers the systematic work, the known risk classes regular testing exists to catch; firmware and binary work needs a specialist provider. For a quick first look at those endpoints, our security header checker shows which HTTP protections your APIs and update servers send. For the full mapping, see our CRA penetration testing guide.

FAQ

This post is informational, not legal advice.