The Cyber Resilience Act From 11 September 2026: Who the 24-Hour Reporting Duty Actually Binds in the Mid-Market

In one month the first genuinely binding part of the Cyber Resilience Act, Regulation (EU) 2024/2847, comes into application. From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents within 24 hours. Three things about that date are widely misread. The duty arrives fifteen months before any security requirement it is supposed to enforce. It reaches products that were sold years ago. And the platform through which reports are meant to be filed is, as of the date of this article, still not open.

What applies on 11 September, and what does not

The asymmetry in that table is the point, and it is rarely stated plainly. What starts in September is the obligation to report. The obligation to build products that meet the security requirements in Annex I, to document them, and to affix a CE marking on that basis, starts in December 2027. For a manufacturer that means a fifteen-month window in which every actively exploited vulnerability has to be reported to a public authority, while the product itself is not yet legally required to have been developed to the standard that would have prevented it.

That is not an oversight by the legislator. Reporting is what gives the authorities visibility before the substantive regime exists. But it does change how a company should sequence its work. Reading the CRA as a 2027 problem and scheduling the whole thing for next year is the single most common planning error we see right now, and it produces the same outcome in every case: the first report is written under time pressure by someone who has never written one.

The definition that catches companies that do not consider themselves manufacturers

Article 3(13) is short and worth reading twice. A manufacturer is a natural or legal person who develops or manufactures products with digital elements, or has products with digital elements designed, developed or manufactured, and markets them under its own name or trademark. The second half is what matters for the mid-market. Commissioning the work does not move the obligation to the party that did it. Putting your own logo on the result moves the obligation to you.

The row that surprises people most is the second one. A company that has an app or a portal developed by an external partner and ships it under its own name is the manufacturer in the legal sense, and the partner is not. We say this as the partner in that arrangement: we build these systems, and the reporting duty still sits with our client, not with us. What can and should be arranged contractually is who technically detects, analyses and drafts. What cannot be arranged away is who is legally obliged to report.

Where the scope actually ends

Half the coverage of the CRA in the last months has been alarmist in a way that does not survive contact with Article 2. Websites, cloud services and SaaS offerings that stand on their own are not in scope. The regulation covers products placed on the market, and it explicitly draws in cloud components only where they are remote data processing solutions: software designed and developed by the manufacturer or under its responsibility, whose absence would prevent the product from performing one of its functions.

That gives you a usable test, and it is a technical question rather than a legal one. Switch the cloud service off in your head. If a customer's device or software then stops doing something it advertises, the service is part of the product. If the customer merely loses a dashboard, a reporting view or a marketing surface, it is not. Most mid-market companies we work with have exactly one component sitting near that line, and it is usually the portal that also delivers firmware updates or licence keys.

Legacy products are the part nobody plans for

Article 69(2) exempts products placed on the market before 11 December 2027 from the regulation, provided they are not substantially modified afterwards. Read on its own, that sounds like a long runway. Article 69(3) then removes it for the one duty that starts first: by way of derogation, the obligations in Article 14 apply to all products with digital elements within scope that were placed on the market before 11 December 2027.

In operational terms this is the heaviest sentence in the regulation for an established manufacturer. The reporting duty does not attach to your next release. It attaches to the installed base, including the controller version you shipped in 2021 and the appliance sitting at a customer who has not called since. Meeting a 24-hour deadline for a product you can still enumerate is a process problem. Meeting it for a fleet you cannot enumerate is not a process problem, it is a data problem, and it takes longer than a month to fix.

What a report looks like

Note what the 24-hour stage does not require. It is an early warning, not an analysis. The most expensive mistake in the first year will be companies that miss the first deadline because they were still trying to understand the incident well enough to describe it properly. The regulation deliberately staged this: warn, then explain, then close.

The gap between the obligation and the tool

Reports are filed through the Single Reporting Platform operated by ENISA, which routes them to the CSIRT designated as coordinator in the member state of the manufacturer's main establishment. ENISA states the platform will be operational by 11 September 2026. As of the date of this article it is not open, there is no public registration URL, and what exists publicly is a factsheet plus two guidance documents on registration and submission, last updated on 31 July 2026.

This is worth saying without drama, because the practical conclusion is unambiguous. The deadlines in Article 14 do not depend on when the tool ships. A company that treats the missing platform as a reason to postpone its own preparation is optimising for the wrong risk. Build the internal process now, decide who is on call, write the templates, and register the moment ENISA opens the door. If you are inside the first weeks after 11 September and the platform is still not usable, document what you did and when, and contact the national CSIRT directly.

Germany: the BSI is the address

For manufacturers established in Germany, the BSI is the counterpart. The federal government named it as notifying and market surveillance authority, and the draft implementing act, Bundestag printed paper 21/6134, gives it four roles: market surveillance, notification of conformity assessment bodies, CSIRT coordinator and reporting point, and support for economic operators. The Bundesrat raised no objections in its first-round opinion on 12 June 2026.

One nuance is worth carrying forward from our piece on the AI Act: where a product falls under both the CRA and the high-risk regime of the AI Act, supervision is intended to follow the AI Act authority instead. For most mid-market manufacturers that combination will not arise. For anyone building AI into a regulated product, it decides who knocks.

And the point that removes the last excuse: the duty comes from the regulation, which applies directly in every member state. It does not wait for the national implementing act. The German law settles who supervises and how sanctions are administered here. It does not settle whether you have to report.

What a breach costs, and one exemption that catches a lot of readers

Article 64 tiers the penalties. Infringements of the essential requirements and of Articles 13 and 14 carry up to EUR 15 million or 2.5 percent of worldwide annual turnover of the preceding financial year, whichever is higher. A list of other obligations sits at EUR 10 million or 2 percent, and supplying incorrect or incomplete information to authorities at EUR 5 million or 1 percent.

More interesting than the ceilings is paragraph 10, which most summaries leave out. Administrative fines are not imposed on manufacturers that are microenterprises or small enterprises for failing to meet the deadline in Article 14(2)(a) or Article 14(4)(a). Those are precisely the two 24-hour early warnings. A small enterprise under the EU definition employs fewer than 50 people and has an annual turnover or balance sheet total of at most EUR 10 million.

What that exemption is not: a release from the duty. The obligation stands, the deadline stands, and neither the 72-hour notification nor the final report is covered. What falls away is the fine for a late early warning. For a company with 30 employees that takes the fear out of 11 September without taking away the work. For a company with 120 employees it does not apply at all, which is worth checking rather than assuming.

And realistically the exposure for a mid-market manufacturer is not the fine. Under Article 54 the market surveillance authority can restrict the making available of a product, withdraw it from the market or order a recall. A sales stop hits a product business harder and faster than a decision on penalties ever will.

What to do in the next four weeks

• Decide whether you are a manufacturer at all. One question, answered in writing: do we place a software or hardware product on the market under our own name. For roughly half the companies that ask us, the honest answer is no, and the whole topic ends there.
• List the products and the versions in the field. Including the ones nobody has touched in three years. Article 69(3) means the installed base is in scope, and this is the item with the longest lead time.
• Draw the line around your cloud components. For each one: would a product function fail without it. That answer determines scope, and it should be written down rather than assumed.
• Name who reports, and who covers them. Twenty-four hours includes nights and weekends. One named person plus one deputy, with a documented route to reach them, is the whole requirement here.
• Write the early warning template now. Half a page, fill in the blanks. The stage that has to be fast is the stage that should not need drafting.
• Set up a way to hear about vulnerabilities. A published security contact address, monitored. The formal disclosure policy is an Annex I item for December 2027, but without an inbox you will learn about an exploited vulnerability from a customer, and by then the clock has been running for a while.
• Put the reporting duty into supplier contracts. If a component vendor detects an exploited vulnerability, you need to hear about it inside your own 24 hours, not inside theirs.

Conclusion

The Cyber Resilience Act is generally filed under 2027, and for its substance that is right. Its first duty is not. From 11 September 2026 the 24-hour clock runs for every manufacturer in scope, for the whole installed base, and it runs whether or not the platform meant to receive the report is open. The work that closes the gap in the next four weeks is small and unglamorous: an honest answer on whether you are a manufacturer, a list of what is in the field, a named person, a template. The companies that get this wrong will not get it wrong on the law. They will get it wrong because on day one nobody knew who was supposed to press send. If you want that assessment done against your actual products rather than a checklist, that is what a first conversation is for, and the neighbouring regime is covered in our piece on the AI Act transparency duties.

Frequently asked questions about CRA reporting from September 2026