Contents7
- 01Who has to report vulnerabilities since 11 September 2026?
- 02What has to be reported, and how fast?
- 03One report, on ENISA’s platform
- 04What does a manufacturer risk if it does not report?
- 05What it changes for a team of 20 to 500 people
- 06Next: the requirements of 11 December 2027
- 07Frequently asked questions
On 11 September 2026, ENISA, the EU cybersecurity agency, switched on the platform where makers of software and connected devices must now report their exploited vulnerabilities. That day, the first obligation of the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, started to apply, fifteen months ahead of the rest of the text.
This briefing from our App development section is up to date as of 20 October 2026. It is not legal advice: to know whether your product is covered and in what capacity, your counsel has the final say.
In short
Since 11 September 2026, the manufacturer of software or a connected device sold in the EU reports its actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours, then a final report.
The obligation also covers products already on the market, and manufacturers established outside the EU.
A single report, on ENISA’s platform, reaches both the competent national authority and ENISA.
The security requirements for the products themselves apply from 11 December 2027.
Who has to report vulnerabilities since 11 September 2026?
The CRA covers “products with digital elements” made available on the EU market that can connect, directly or indirectly, to a device or a network. According to the analysis by law firm McCann FitzGerald, based on the guidance the Commission published in July 2026, that includes standalone software, hardware with its embedded software, and combinations of both. The regulation applies to any operator selling in Europe, wherever it is established.
Three points matter for a mid-sized business:
- The manufacturer is not necessarily whoever writes the code. A business that has a product developed and markets it under its own name is its manufacturer; an importer or distributor becomes one if it sells the product under its own brand or substantially modifies it.
- Products already sold are covered. The reporting obligation has applied since 11 September 2026 to every covered product already made available on the market, as law firm Hogan Lovells points out, citing Article 69 of the regulation. That reading is a law firm’s, not a quotation from the Official Journal: before drawing a conclusion for a specific product, read Article 69 in the text of Regulation (EU) 2024/2847 on EUR-Lex.
- A purely internal application that you make available to no one outside the company raises a different question, to settle with your counsel.
What has to be reported, and how fast?
Two events trigger the obligation. The first is a flaw already used by an attacker:
Definition
Actively exploited vulnerability
A vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system. A flaw found internally and fixed before any attack is not one.
The second is a severe incident: one that affects, or could affect, the product’s ability to protect important data or functions, or that has allowed malicious code to be introduced or run in the product or the user’s network. For both, the Commission’s page on reporting sets the same sequence:
- Within 24 hours
An early warning, counted from the moment the manufacturer becomes aware of the vulnerability or incident.
- Within 72 hours
The full notification, with what the manufacturer knows about the flaw and the measures taken.
- Within 14 days of the fix
The final report for an exploited vulnerability, once a corrective or mitigating measure is available.
- Within one month of the notification
The final report for a severe incident.
The manufacturer must also inform the affected users, and all users where appropriate; if it fails to do so in time, the national authority may do it instead, according to Hogan Lovells.
One report, on ENISA’s platform
So that a publisher does not report the same flaw in every country where it sells, the regulation sets up a single entry point. The report reaches the national computer security incident response team (CSIRT) of the country where the manufacturer has its main establishment, and ENISA at the same time; that CSIRT then passes it on to the other countries where the product is sold.
ENISA’s page on the single reporting platform: since 11 September 2026, manufacturers file their mandatory notifications there. Captured on 20 October 2026.
ENISA announced its launch on the day, with FAQs, guides and a help desk. Maintainers of open-source software involved in developing products, called “stewards”, will join it on 11 December 2027.
What does a manufacturer risk if it does not report?
Breaching the reporting obligation falls into the regulation’s highest penalty tier:
at most for an infringement of the reporting obligations
of total worldwide annual turnover, if that amount is higher
There are two softeners: micro and small enterprises are not fined for merely missing the 24-hour early warning deadline, and open-source stewards are not subject to administrative fines. The 72-hour deadline applies to everyone. These amounts and this exemption come from Hogan Lovells’ analysis, which refers to Articles 64 and 71 of the regulation, not from our own reading of the Official Journal: before committing to a budget or a contract, check them in Regulation (EU) 2024/2847 as published in the OJ (we noted them on 20 October 2026).
What it changes for a team of 20 to 500 people
The 24-hour clock starts when you know. It therefore rewards teams that find out fast, not those that find out from a customer. That is the real benefit of the obligation: it forces you to put in place what lowers the cost of a vulnerability anyway.
- Know what you sell.
The list of your applications and connected devices in circulation, with their versions and the components they ship: without it, you cannot tell within an hour whether a published flaw affects you.
- Hear about it early.
Monitoring that alerts on abnormal behaviour, and an address where a researcher or customer can report a flaw, read every day.
- Decide who reports.
A named person, and a backup, with an account already created on ENISA’s platform, rather than a sign-up in the middle of an incident.
- Be able to fix fast.
The final report for an exploited vulnerability is counted from the moment a fix is available: a delivery pipeline that ships a fix within hours shortens everything else.
From the field
Fixing fast means shipping often
Between version 1.0 on 2 September 2026 and version 1.58.3 on 6 October 2026, Challenge Us, a group challenge app whose development we handle for its team, went through 108 versions (internal measurement, from the app’s version history, as of 6 October 2026; this pace is not a commitment for another project). That pace holds because each version is small, checked by automated tests, and its web version is served directly, without waiting for a store review. It is exactly what a publisher needs when a reporting clock is running.
How you publish matters here: a fix to a store app waits for Apple’s or Google’s review, while a progressive web app updates as soon as it goes live. We compare the two routes in PWA or store app. The cost of this vigilance is part of the real cost of an application, covered in what drives the price of an app and in the maintenance budget of an app. For the alerting itself, the method we use to monitor our automations applies to an application too.
If you buy software rather than publish it, the CRA helps you as well: ask your vendors who receives vulnerability reports on their side, how they will warn you about an exploited flaw, and how often they ship fixes. A clear answer says a lot about their maturity.
Next: the requirements of 11 December 2027
Reporting is only the first step. From 11 December 2027, products placed on the market must meet the regulation’s essential cybersecurity requirements, ENISA reminds. The CRA comes on top of NIS2, which targets organisations rather than products and is still awaiting transposition in France, as we explain in our briefing on the Resilience bill. All these dates are gathered in our digital regulation calendar.
If you are having an application built and want monitoring, updates and the reporting procedure planned from day one, that is the scope of our app development offer.
Frequently asked questions
Does the Cyber Resilience Act apply to apps already published?
Yes, for reporting: since 11 September 2026, the obligation to report actively exploited vulnerabilities and severe incidents covers every covered product already made available on the EU market. The essential cybersecurity requirements apply to products placed on the market from 11 December 2027.
Do all discovered vulnerabilities have to be reported?
No. The obligation covers actively exploited vulnerabilities, meaning those with reliable evidence of exploitation by a malicious actor, and severe incidents. A flaw found and fixed before any attack falls under your normal vulnerability management, not a mandatory notification to the authorities.
Where do you report a vulnerability under the CRA?
On ENISA’s single reporting platform, live since 11 September 2026. The report reaches at the same time the national incident response team of the country of the manufacturer’s main establishment and ENISA, which pass it on to the other countries concerned.
Is a business that has its app built by an agency the manufacturer?
Usually yes, if it markets the app under its own name or brand: the manufacturer is whoever places the product on the market, whether it developed it itself or had it developed. The contract with the agency should then say who monitors, who fixes, and within what time.
Sources
- The analysis by law firm McCann FitzGerald (new tab)mccannfitzgerald.com
- Law firm Hogan Lovells (new tab)hlc.com
- The text of Regulation (EU) 2024/2847 on EUR-Lex (new tab)eur-lex.europa.eu
- The Commission’s page on reporting (new tab)digital-strategy.ec.europa.eu
- Announced its launch (new tab)enisa.europa.eu
Jim · founder of Brain Plus AI
Also in web and mobile apps
Understand9 min
AI Act and digital rules calendar: deadlines 2026 to 2028
AI Act, Data Act, Cyber Resilience Act, NIS2, e-invoicing in France and the first US state laws: every date that matters for a business, from autumn 2026 to August 2028, on one page kept up to date. For each deadline, who is covered and what to prepare.
Choose and price6 min
How much an app costs: what makes the price vary
A price range says nothing about your project: what makes an app quote vary is a handful of specific decisions, plus a monthly running cost to be priced separately. Here they are.
Choose and price6 min
PWA or native app: which to choose for your business?
An installable web app (PWA) goes onto the home screen without going through the App Store or Google Play, and is enough in many cases, not all. Here is how to decide, and why we start with it.