PSIRT & disclosure
CRA vulnerability reporting: the 24-hour early warning, 72-hour notification and final report
Under the Cyber Resilience Act, a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident affecting its product must send an early warning within 24 hours, a notification within 72 hours, and a final report later. Everything goes through the ENISA Single Reporting Platform to the national CSIRT coordinator and ENISA at the same time. This has applied since 11 September 2026.
For the full picture of the regulation, see the Cyber Resilience Act hub.
Key takeaways
- For the full picture of the regulation, see the Cyber Resilience Act hub.
- A researcher's report of a bug that nobody has exploited is not a mandatory notification.
- The CSIRT may also ask for an intermediate report on status updates (Art.
- Channel: the Single Reporting Platform established by ENISA under Article 16.
What triggers a mandatory report?
| Trigger | Definition in the CRA |
|---|---|
| Actively exploited vulnerability | A vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission (Art. 3) |
| Severe incident affecting product security | An incident that harms, or can harm, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or that has led or can lead to malicious code being introduced or executed in the product or the user's systems (Art. 14(5)) |
A researcher's report of a bug that nobody has exploited is not a mandatory notification. It is handled through your coordinated vulnerability disclosure process and fixed under Annex I Part II. You may notify it voluntarily (Art. 15).
The clock starts when you become aware. Evidence of exploitation can come from a researcher, a customer, a CSIRT, a threat-intelligence feed or your own telemetry.
The three reports for an exploited vulnerability
| Report | Deadline | Minimum content (Art. 14(2)) |
|---|---|---|
| Early warning | Without undue delay, at most 24 hours after awareness | That an actively exploited vulnerability exists; where applicable, the Member States where the product is made available |
| Vulnerability notification | At most 72 hours after awareness | General information on the product, the nature of the exploit and vulnerability, corrective or mitigating measures taken and those users can take, and how sensitive you consider the information |
| Final report | At most 14 days after a corrective or mitigating measure is available | Description, severity and impact; information on the malicious actor where available; details of the security update or other corrective measures |
The three reports for a severe incident
| Report | Deadline | Minimum content (Art. 14(4)) |
|---|---|---|
| Early warning | At most 24 hours after awareness | Whether the incident is suspected to be caused by unlawful or malicious acts; where applicable, the Member States where the product is available |
| Incident notification | At most 72 hours after awareness | Nature of the incident, initial assessment, corrective or mitigating measures taken and those users can take, sensitivity |
| Final report | Within one month after the 72-hour notification | Detailed description, severity and impact; likely threat type or root cause; applied and ongoing mitigations |
The CSIRT may also ask for an intermediate report on status updates (Art. 14(6)).
Where to send it
- Channel: the Single Reporting Platform established by ENISA under Article 16. ENISA deployed its initial operating capability on 11 September 2026; the portal is at
portal.cra-srp.enisa.europa.eu. - Recipient: the CSIRT designated as coordinator in the Member State of your main establishment in the EU, meaning where cybersecurity decisions for your products are mainly taken (or, failing that, where you have the most EU employees). ENISA receives the notification simultaneously (Art. 14(7)).
- Non-EU manufacturers use the CSIRT of the Member State determined in this order: where your authorised representative for most of your products is established; else your importer for most products; else your distributor for most products; else where most of your users are located.
- The receiving CSIRT shares the notification with the CSIRTs of the Member States where the product is available. It can delay that only in exceptional, justified cases (Art. 16(2)).
Account set-up and access steps vary by organisation type and are described in ENISA's SRP user manuals.
Tell your users too
Separately from the authorities, you must inform impacted users, and where appropriate all users, about the exploited vulnerability or incident and any mitigations they can apply, where appropriate in a structured, machine-readable format (Art. 14(8)). If you do not do this in time, the CSIRT may inform users itself.
What to prepare before the first incident
A triage rulethat defines "reliable evidence of exploitation" for your products, and who signs off. An on-call rosterthat covers weekends and holidays. A 24-hour deadline does not pause. Product data ready to paste: model names, firmware versions, the Member States where each is sold, and the SBOM per version. SRP access testedin advance, with at least two people able to submit. Pre-written templatesfor the early warning, 72-hour notification, final report and user advisory. A link to your disclosure intake: reports arrive through your published policy and security contact. Use our VDP template and security.txt guide. Evidence logging: when you became aware, what you knew, and what you sent. Authorities will look at the timeline.
Common mistakes
- Waiting for a patch before the early warning. The 24-hour report does not need a fix; the final report comes after the fix.
- Treating only your own code as relevant. A vulnerability in a third-party library inside your firmware is a vulnerability in your product.
- Forgetting legacy models. Products placed on the market before 11 December 2027 are covered by Article 14 too.
Fines and the small-company carve-out
Breaching Article 14 falls under the highest fine band: up to EUR 15 million or 2.5% of worldwide annual turnover (Art. 64(2)). Micro and small enterprises are not fined for missing the 24-hour early-warning deadline (Art. 64(10)), but they still have to report.
Where AI speeds up the 72-hour notification, not the 24-hour judgment call
Deciding whether a report meets the "actively exploited" bar within 24 hours is a human judgment call the rules keep with the manufacturer; no automated scan should make that call. Once that threshold is confirmed, the 72-hour notification and the final report need the same product, component and CVE detail SoftWSP's firmware scan already extracts and matches against CVE, KEV and EPSS data. AI drafts the plain-language notification and remediation-advice text from those matches — which component, which fix, which affected versions — for an engineer or PSIRT analyst to review and submit; it narrates evidence the scan already produced, and does not itself decide that a vulnerability is actively exploited.
SoftWSP runs intake, triage and CRA notifications for device makers that have no in-house PSIRT: see PSIRT as a service. For the wider task list, use the CRA checklist for device makers.
This guide is general information, not legal advice.
Put this guide to work
Frequently asked questions
When does the CRA 24-hour reporting obligation apply?
Article 14 has applied since 11 September 2026. It covers all in-scope products, including those placed on the EU market before 11 December 2027.
What must be reported within 24 hours?
An early warning for any actively exploited vulnerability in your product, and for any severe incident affecting its security, within 24 hours of becoming aware of it.
Where do I submit CRA notifications?
Through the Single Reporting Platform run by ENISA, using the electronic end-point of the CSIRT designated as coordinator in the Member State of your main EU establishment. The notification is made available to ENISA at the same time.
Does every vulnerability report need to be notified?
No. The mandatory duty covers actively exploited vulnerabilities, meaning there is reliable evidence a malicious actor exploited it without the system owner's permission, and severe incidents. Other vulnerabilities can be notified voluntarily.
Can a small company be fined for missing the 24-hour deadline?
Article 64(10) states that administrative fines are not applied to micro and small enterprises for missing the 24-hour early-warning deadline. The other obligations still apply.
Sources
About this guide
SoftWSP Firmware Security Desk
Covers the PSIRT & disclosure cluster: 14 guides.
In this cluster
Questions about this page?