CRA reporting is live. Suppliers: 24 hours early warning, 72 hours notification

When the clock starts

The Cyber Resilience Act's reporting rules went live on 11 September 2026, and they work like losing your bank card: the clock starts when you notice it's gone, not when it suits you. A supplier who becomes aware of an actively exploited vulnerability or a serious incident has 24 hours to send an early warning and 72 hours to file a full notification ^[1].

That's shorter than most companies' internal escalation procedures, which is the point. The early warning is meant to be brief and fast, and the full notification can follow once you know more. But the deadlines count from awareness, so if someone in support spots the issue on a Friday afternoon and the decision to escalate takes until Monday, you've already lost a day.

What gets reported

Not every bug or customer complaint triggers the duty. Article 14 applies to actively exploited vulnerabilities, meaning someone is already using the flaw in the wild, and to serious incidents ^[1]. A serious incident is one that has caused or is likely to cause significant harm, such as personal injury, major disruption or substantial material damage.

The test is whether the issue affects a product with digital elements, whether it's being exploited or has caused real harm, and whether you're the manufacturer. Medical devices and type-approved vehicles stay out, because they have their own reporting regimes ^[1].

One platform, short deadlines

Reporting happens through ENISA's single reporting platform, the same channel used for other EU cybersecurity rules ^[1]. The idea is to keep it simple: one login, one form, rather than a different portal for each regulation.

The early warning is the lighter step. It asks for the basics: what's been exploited, which products are affected and what you're doing about it. You have 24 hours from awareness. The full notification, due within 72 hours, adds detail: the scope of the incident, which users are at risk, and any mitigations you've put in place.

Miss the deadlines and the penalty can go up to 15 million euros or 2.5 per cent of global annual turnover, whichever is higher ^[1].

The incident timeline nobody rewrites

The 24-hour and 72-hour deadlines start from awareness, which is a fact question. When did the first engineer see the alert? When did the support team realise it wasn't just one customer? When did the decision to escalate land in someone's inbox?

Those moments get questioned later, especially if a regulator wants to know why the early warning went out after 30 hours instead of 24. A log its operator can quietly edit is easy to challenge. A sealed timeline is harder to dispute.

Here, the thing to seal is each step of the incident as it happens: the first detection note, the decision to escalate, and each report as it is sent to ENISA's platform. Sealing takes a fingerprint of the record, not the record itself, so sensitive incident details never leave your systems. The fingerprint is written to WitniumChain, and anyone you share the sealed record with, such as an auditor or a supervisor, can later check that it hasn't changed since it was sealed.

It doesn't show that the report was complete or that the response was adequate. It shows when each step was recorded, in a way nobody can quietly rewrite afterwards. Internal audit, supervisors and insurers can check it. Seal the detection note when the engineer writes it, seal the escalation decision when it's made, and seal each report as it goes out. The content stays with you; only the fingerprint is sealed. Read more in the documentation.

How it would work

1. The engineer writes the first detection note. Your system seals a fingerprint of it and gets a witness ID back.
2. The decision to escalate is recorded and sealed the same way.
3. The early warning is sent to ENISA and sealed before it leaves.

Anyone you share the sealed records with can check that they match the fingerprints and haven't changed.

What this means for you

If you supply connected hardware or software covered by the CRA, ask yourself:

• Who in our organisation sees the first signs of an actively exploited vulnerability or a serious incident, and how quickly does it reach the people who can escalate?
• Can we show, six months later, when we first became aware of an issue?
• Do our systems let us send an early warning within 24 hours from awareness, even at a weekend?

The CRA's product requirements, including logging and vulnerability handling, don't apply until 11 December 2027 ^[2]. The reporting duty is already here.

What to watch

11 December 2027: the date when products with digital elements must meet the essential cybersecurity requirements in Annex I of the CRA, including the ability to log and monitor security-relevant events ^[2].

Sources

1. Regulation (EU) 2024/2847 of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Article 14, European Commission, 11 December 2024, https://eur-lex.europa.eu/eli/reg/2024/2847/oj
2. Regulation (EU) 2024/2847, Annex I (essential cybersecurity requirements), European Commission, 11 December 2024, https://eur-lex.europa.eu/eli/reg/2024/2847/oj
3. ENISA's single reporting platform for cybersecurity incidents, ENISA, accessed 9 October 2026, https://www.enisa.europa.eu/topics/incident-response