CRA's *24-hour reporting window* starts when you notice, not when it suits

When the clock starts

The 24-hour rule in the Cyber Resilience Act works like losing your bank card: the clock starts when you notice it's gone, not when reporting feels convenient. Article 14 says manufacturers must report actively exploited vulnerabilities and severe incidents within 24 hours of becoming aware, and there's no grace period for having been busy with something else ^[1].

That window applies from 11 September 2026, and it runs through ENISA's Single Reporting Platform. ECSO and ENISA are now holding a workshop to walk manufacturers through how the platform works and what counts as timely ^[2].

What must be reported

Two things trigger the 24-hour duty: actively exploited vulnerabilities, meaning someone is already using the flaw in the wild, and severe incidents, meaning something has happened that affects the security of the product in a way that matters ^[1]. The workshop on 13 February addresses how manufacturers are expected to judge that in practice, and what information the platform asks for ^[2].

The duty sits with manufacturers of products with digital elements. That's connected hardware and software, broadly speaking, but not medical devices under the Medical Device Regulation or vehicles covered by type approval ^[1]. If your product has a network connection and doesn't fall into one of those carve-outs, you're likely in.

A short reporting chain

The first report goes through the Single Reporting Platform, which ENISA runs. Within 24 hours, manufacturers give an early warning. Within 72 hours, they send an incident notification with more detail, and when the incident is resolved or contained, a final report follows ^[1].

That's three steps, each with its own deadline, and all of them count from when the manufacturer became aware. The 24-hour window for the early warning is the tightest, and it's where most questions will land. Knowing when you knew becomes a question worth being able to answer, and it's the kind of question where a contemporaneous note is easier to defend than a reconstruction months later.

When you knew, and when you reported

Say a vulnerability is flagged internally on a Tuesday afternoon, and the early warning goes out on Thursday morning. A supervisor asks why it took 36 hours instead of 24. The answer will depend on being able to show when the relevant person first saw the alert, when it was escalated and when the decision to report was made.

That's where a sealed record of each step helps. A detection note, a decision to escalate and the report itself, each sealed as it happens, make it straightforward to show the timeline without having to rely on memory or logs someone could later question. The fingerprint is taken when the note is written, so nobody can quietly adjust the time afterwards, not even someone with administrator rights.

How it would work

1. Seal the detection note as soon as the vulnerability or incident is logged internally.
2. Seal the escalation decision when someone decides it meets the reporting threshold.
3. Seal each report (early warning, incident notification, final report) as it is sent through the platform.

Anyone checking later can see that each step was recorded at the time shown, unchanged since. It doesn't show that the report was complete or that the response was adequate, but it does show when you knew and when you acted.

The content stays in your systems. WitniumChain takes a fingerprint, not the data, through the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free, and the documentation walks through how to integrate it.

What this means for you

If you manufacture products with digital elements and they'll reach the market after 11 September 2026, a few questions are worth asking now:

• Do you have a process for deciding, within hours, whether something meets the reporting threshold? The tighter the deadline, the less room there is for a committee.
• Can you show when you first became aware of an incident? A timestamped internal note, sealed as it's written, is simpler to defend than an estimate made six months later.
• Who in your organisation knows how the Single Reporting Platform works? The workshop on 13 February is a chance to find out before the duty applies ^[2].

What to watch

11 September 2026: The reporting duty in Article 14 applies. Actively exploited vulnerabilities and severe incidents must be reported within 24 hours ^[1].

11 December 2027: The essential requirements in Annex I apply, including logging and monitoring of security-relevant events for products with digital elements ^[3].