[Home](/)/[Resources](/resources)/EU Cyber Resilience Act Vulnerability Reporting EUCybersecurityRegulation guide # EU Cyber Resilience Act Vulnerability Reporting Beyond the Cyber Resilience Act's design requirements sits a time-pressured obligation: when you discover an actively exploited vulnerability or severe incident, the clock starts on a strict, staged reporting timeline to ENISA and CSIRTs -- not a leisurely internal process. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Feu-cra-vulnerability-reporting-obligations) At a glance Regulation (EU) 2024/2847 Early warning deadline 24 hours after becoming aware Full notification deadline 72 hours after becoming aware Final report deadline 14 days after a fix is available Reported to ENISA / designated CSIRT ## What triggers the reporting clock ### Two distinct trigger events The CRA's reporting obligations are triggered separately by an actively exploited vulnerability, and a severe incident having an impact on the security of a product with digital elements. ### "Becoming aware" starts the countdown The deadlines run from the moment the manufacturer becomes aware of the qualifying event, not from when it was first introduced. ### This is a manufacturer obligation, not just a "nice to have" This is a binding legal reporting obligation tied to specific deadlines -- missing them is a compliance failure independent of how well the vulnerability was eventually fixed. ## The staged reporting timeline 01 Early warning, within 24 hours of becoming aware: a brief initial notification to ENISA via the designated CSIRT. 02 Notification, within 72 hours: a more complete report including a severity and impact assessment. 03 Intermediate status updates as requested by the CSIRT or ENISA for an incident that remains unresolved. 04 Final report, within 14 days after a corrective measure becomes available. 05 In parallel, affected users generally need to be informed of the vulnerability and any corrective measures they should take. ## Building a process that can actually meet these deadlines ### 24 hours is shorter than most internal incident processes Meeting the 24-hour early warning deadline typically requires a pre-built, on-call escalation path designed specifically for this trigger. ### Know your CSIRT and reporting channel before you need it Identify the designated CSIRT and reporting mechanism applicable to your products in advance. ### Coordinate security and product/legal teams ahead of time Decide in advance who is authorized to file the early warning with limited information, so the process doesn't stall waiting for full sign-off. ## Frequently asked questions ### Does every vulnerability need to be reported within 24 hours? No -- the strict clock applies specifically to actively exploited vulnerabilities and severe incidents, not to every vulnerability discovered through routine testing. ### Who do I actually report to? Reports go to ENISA, generally via the CSIRT designated for this purpose under the CRA's coordinated vulnerability disclosure framework. ### What happens if I miss the 24-hour deadline? Missing the deadline is a compliance failure under the CRA in its own right, separate from how the vulnerability is eventually remediated. ### Do I also have to tell my customers, or just the regulator? Both, generally -- alongside regulatory reporting, manufacturers are expected to inform affected users of the vulnerability and any corrective measures. **Disclaimer:** This page is an educational resource only and does not constitute legal advice. Cyber Resilience Act reporting mechanisms continue to be finalized as the regulation's obligations phase in -- consult current ENISA guidance and qualified counsel before finalizing an incident-response process. 🇪🇺 CE Marking roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇪🇺 CE Marking compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $199](/courses/40-eu-cyber-resilience-act-cra-connected-products)[Prefer to read? Get the book — $24.99](/books/40-eu-cyber-resilience-act-cra-connected-products) Related guides * [EU Cyber Resilience ActEU Cyber Resilience Act for hardware: default-secure requirements, vulnerability disclosure, 24-hour incident notification, and the four Annex I product classes.](/guides/eu-cyber-resilience-act) * [RED Cybersecurity Delegated ActCommission Delegated Regulation (EU) 2022/30 activates RED Article 3.3(d)(e)(f) for Wi-Fi, Bluetooth, and cellular products.](/guides/red-cybersecurity-delegated-act) * [EU NIS2 Directive for HardwareNIS2 Directive (EU) 2022/2555 extends cybersecurity obligations to manufacturers of connected products and critical infrastruct…](/guides/eu-nis2-directive-hardware) * [FCC Cyber Trust MarkEligible categories, the NIST baseline, and the accredited-lab testing process for the US IoT cybersecurity label.](/guides/fcc-cyber-trust-mark)