CRA in Practice: From Reporting to Demonstrating Compliance

The first Cyber Resilience Act obligations are already in effect, while the technical framework for demonstrating compliance continues to take shape.

Since 11 September 2026, manufacturers of products with digital elements have been required to report actively exploited vulnerabilities and severe security incidents. For this purpose, ENISA has launched the Single Reporting Platform (SRP) as the common reporting mechanism.

The timelines are demanding. Manufacturers are generally required to submit an early warning within 24 hours of becoming aware of an event and a full notification within 72 hours. For actively exploited vulnerabilities, a final report must follow no later than 14 days after a corrective or mitigating measure becomes available. For severe incidents, the final report is due within one month of the 72-hour notification.

However, reporting is only the first step. Most CRA requirements will apply from 11 December 2027, which means manufacturers increasingly need to consider how they will demonstrate the cybersecurity of their products in practice.

The CRA does not rely on a single technical standard. A broader set of horizontal and product-specific standards is being developed to support manufacturers in demonstrating conformity with the Regulation. This standardisation work is still ongoing.

Manufacturers should therefore not wait for the complete set of standards before starting their technical preparations. Cybersecurity risk assessment, security architecture, vulnerability and update management and technical verification of security functions should already form part of CRA readiness activities.

The CRA is no longer simply a regulation to prepare for by 2027. Its first obligations are already in effect, while the technical preparation of products is becoming increasingly important.

More information:
Gregor Zakrajšek
E-mail: gregor.zakrajsek@siq.si
Tel.: +386 1 4778 034