CRA's 24-hour reporting rule starts in September 2026

When the clock starts

The 24 hours in the Cyber Resilience Act work like when you lose your bank card: the clock starts when you notice it's gone, not when it's convenient to call the bank. Manufacturers of products with digital elements must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a serious incident ^[1].

The duty applies from 11 September 2026. It covers connected hardware and software, but not medical devices or vehicles with type approval ^[1]. Reports go through ENISA's single reporting platform, and there are further deadlines for updates: an incident notification within 72 hours, an intermediate report within a month, and a final report when the handling is complete ^[1].

Fines for non-compliance can reach €15 million or 2.5 percent of worldwide annual turnover, whichever is higher ^[1].

Becoming aware is the trigger

The rule doesn't say "within 24 hours of the incident". It says within 24 hours of becoming aware ^[1]. That makes the moment of awareness the fact to prove. When did someone in the organisation first see the alert, the customer report or the unusual log entry? If a supervisor later asks why the early warning went out after 30 hours, the answer has to show when awareness began.

That's harder than it sounds. Email timestamps can be questioned. Internal chat messages don't always carry enough context. A detection tool might log an event, but if nobody looked at it until the next day, when did awareness start?

What this means for you

If you make or sell products covered by CRA, here are three questions to ask now:

• Who in your organisation sees security alerts first, and how is that documented?
• Can you show, in a way a supervisor would accept, when the first person became aware of an incident?
• Does your incident process include a step that records awareness, escalation and each report as they happen?

The early warning doesn't need to be perfect. It's a signal that you know something is happening and are looking into it ^[1]. But it does need to go out on time, and you need to be able to show that it did.

Sealing an incident timeline as it happens

Here, the thing to seal is each step of the incident as it unfolds: the first detection note when someone spots the problem, the decision to escalate it, and each report as it is sent. Sealing takes a fingerprint of the record, not the record itself, so the details of the incident stay in your systems.

Anyone you share the timeline with—a supervisor, an auditor, an insurer—can later check that each step is exactly what was recorded at that time. If the early warning record says it was sent at 14:32 on Tuesday, a check against the sealed fingerprint will show whether that record has changed since. Change a single character in it and the fingerprint won't match.

WitniumChain does this through a REST API, an SDK or an MCP server. The content never leaves your organisation. The first 2,000 witnesses a month are free ^[2].

What it shows is when each step was recorded, in a way nobody can quietly rewrite afterwards. What it doesn't show is that the report was complete, that the response was adequate, or that the incident was handled well. Those are separate questions. The witness answers a narrower one: did this record exist at this time, and has it changed since?

How it would work

1. Your incident system logs the first detection and sends a fingerprint to WitniumChain, getting a witness ID back.
2. When the early warning is sent, that record is sealed the same way.
3. If a supervisor asks when awareness began, you show the sealed detection record and let them check the fingerprint.

A sealed step is a receipt

The CRA reporting duty is one of several rules that count hours from a moment in time. The Swedish Cybersecurity Act has similar deadlines for organisations of essential or important societal functions ^[3]. The whistleblowing directive requires confirmation within seven days ^[4]. DORA asks financial entities to classify incidents quickly and report them under tight deadlines ^[5].

In each case, the question later is: when did you know, and what did you do? A sealed record of each step gives you a receipt you can check. It doesn't make the handling faster or better, but it does mean you can show what happened and when, without asking anyone to take your word for it.

What to watch

The Cyber Resilience Act's reporting platform is being set up now. The first real test will come when manufacturers start reporting in late 2026. By then, the pattern will be familiar: tight deadlines, high stakes, and a requirement to show not just that you acted, but when.

If your products are in scope, September is the month to get your incident process ready, including the part that proves when the clock started.