CRA reporting obligations - how they work

01

What must be reported?

Manufacturers must report two kinds of events:

• Actively exploited vulnerabilities - vulnerabilities in the product for which there is reliable evidence that someone has exploited them.
• Severe incidents affecting the security of the product - for example an incident affecting its ability to protect data or functions, or one that has led to malicious code being introduced into the product or its updates.

02

Deadlines

The deadlines run from when the manufacturer becomes aware of the event:

• Early warning - without undue delay and at the latest within 24 hours.
• Notification with more information - at the latest within 72 hours.
• Final report for a vulnerability - no later than 14 days after a corrective or mitigating measure is available.
• Final report for a severe incident - within one month of the notification.

03

Where do you report?

Reports are submitted through ENISA's single reporting platform. They go to the CSIRT designated as coordinator in the country where the manufacturer has its main establishment - in Sweden CERT-SE at the National Cybersecurity Center (NCSC) - and are made available to ENISA at the same time.

04

Inform users

After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer must also inform the affected users, and where appropriate all users, about the event and about measures they can take to mitigate its impact.

05

Internal process

24 hours is not long. Have this in place before anything happens:

• A contact point where researchers, customers and suppliers can report vulnerabilities.
• A designated owner and a deputy who can decide on reporting around the clock.
• An up-to-date SBOM, so you can quickly see which products and versions a component vulnerability affects.
• An account and permissions on the reporting platform set up in advance.
• Templates for the early warning, notification, final report and user communication.
• A log of every event with times, assessments and decisions.

06

How it differs from NIS2 and GDPR

The CRA covers vulnerabilities and incidents in products you sell. The Cybersecurity Act (NIS2) covers significant incidents in your own operations, with the same 24 and 72 hours but a final report within one month. GDPR covers personal data breaches, notified to IMY within 72 hours. A single event - for example a breach of an update server - could in the worst case trigger all three.