From 11 September 2026, any company selling a “product with digital elements” in the EU, hardware or software, must report actively exploited vulnerabilities and severe security incidents within 24 hours. Most Swedish SaaS, hardware and connected-device companies are affected, whether they have registered for it yet or not.
What changed
From today, 11 September 2026, any company that makes a “product with digital elements” and sells it in the EU has a new legal duty: report actively exploited vulnerabilities and severe security incidents to the authorities within 24 hours of finding out. This is the first reporting deadline under the EU’s Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, and it is now live.
The CRA itself entered into force back on 10 December 2024, but most of its duties, such as CE-marking connected products and running a full conformity assessment, only bite from 11 December 2027. Article 14 of the CRA singles out reporting as the one duty that starts much earlier. The European Commission and ENISA, the EU’s cybersecurity agency, have both confirmed that the reporting window opens today and that the EU’s central intake system, the Single Reporting Platform (SRP), is operational from the same date.
Why it matters
“Product with digital elements” is a deliberately wide net. It is not just routers and smart thermostats. A Swedish SaaS company whose app connects to the internet, a hardware startup shipping a connected sensor, and a fintech building software that talks to a bank’s API can all fall inside scope, whether or not anyone at the company has thought about the CRA before. If your product can connect to a device or a network, directly or indirectly, assume it counts until a lawyer tells you otherwise.
Picture a Swedish company selling a connected payment terminal. A security researcher emails on a Tuesday afternoon to say a vulnerability in the terminal’s firmware is being actively exploited in the wild. Before today, that was a product-security problem handled on the company’s own timeline. From today, it is a legal deadline: an early warning to the authorities within 24 hours of the company becoming aware that the exploitation is real, a fuller notification within 72 hours, and a final report once a fix exists. Missing that window is not just a security failure. It is a breach of EU law.
From when
Three dates matter here. The CRA entered into force on 10 December 2024. The reporting duty under Article 14, the subject of this article, applies from today, 11 September 2026. The bulk of the CRA’s other obligations, including CE marking and conformity assessment for new products, apply from 11 December 2027. Companies sometimes conflate these dates; they should not. The reporting clock is running now, more than a year before the wider regime takes effect.
Mechanically, a manufacturer reports once, through the Single Reporting Platform, to the national CSIRT (Computer Security Incident Response Team) where it has its main establishment, with the same information automatically shared with ENISA. Representatives need an EU Login account to access the platform; there is, at least for now, no API, so this is a manual process, not something you can quietly bolt onto existing tooling.
What to do
Five things are worth doing this week, not next quarter. The first is to work out, concretely, whether any of your products or software fall inside the CRA’s definition of a product with digital elements. This includes commercial open-source software, not only boxed hardware. The second is to set up an internal escalation procedure, with one named owner, for deciding when a reported bug crosses the line into “actively exploited” or a “severe incident” under the CRA. Waiting to figure this out during an actual incident is how companies miss a 24-hour deadline.
The third is to register for an EU Login account now, before you need it, so that whoever will file a report is not blocked at the door during a live incident. The fourth is to identify which CSIRT is actually responsible for your company. For a manufacturer established in Sweden, CERT-SE is the natural starting point, though its own guidance currently names the 11 September start date without spelling out the 24/72-hour deadlines or giving a dedicated CRA reporting address. In practice that means leaning on the Commission’s and ENISA’s own pages rather than assuming your national authority will hand you the details. The fifth is to map how a CRA report interacts with your existing NIS2 incident-reporting duties and GDPR personal-data-breach obligations, so that one security incident does not trigger three uncoordinated, inconsistent reports to three different authorities.
Where the law is genuinely still unsettled, it is worth saying so rather than pretending otherwise. The Commission published non-binding guidance on CRA implementation on 27 July 2026, but it has not adopted a binding implementing act that sets out the exact format and procedure for notifications, and exactly what triggers “becoming aware” of an actively exploited vulnerability has not been tested in practice. Build your internal process to be defensible, not to chase a precision the law itself does not yet offer.
Close
The CRA’s reporting duty is a small piece of a much larger regulation, but it is the piece with teeth right now, while the rest of the Act is still a year away. We covered the CRA’s broader obligations in an earlier piece; this is the part of it that actually has a clock running today. If you are not sure whether your product is in scope, or your incident response plan has never been tested against a 24-hour legal deadline, that is worth fixing before an incident forces the question. Lawgent helps technology and hardware companies map their Cyber Resilience Act exposure and build a reporting process that holds up under pressure.
This is general information, not legal advice for your specific situation.
Sources
- European Commission — Cyber Resilience Act, Reporting obligations
- European Commission — The Cyber Resilience Act: summary of the legislative text
- European Commission — guidance to support timely Cyber Resilience Act implementation, 27 July 2026
- ENISA — Single Reporting Platform (SRP)
- CERT-SE — Rapportera
- Regulation (EU) 2024/2847 of the European Parliament and of the Council (Cyber Resilience Act), Official Journal of the European Union
