Why the EU CRA Impact Starts Now and How to Prepare

The EU Cyber Resilience Act (CRA) requires manufacturers to build cybersecurity features directly into products with digital elements before they enter the EU market. The CRA emphasizes secure-by-design principles and mandates ongoing security assessments and updates throughout a product’s lifecycle. 

While full CRA obligations apply starting December 11, 2027, key reporting requirements took effect in September 2026. Manufacturers, importers, and distributors must ensure active compliance now for products currently supported on the EU market.

CRA impact starts now, not in 2027

Reporting obligations

On September 11, 2026, CRA reporting obligations took effect. Manufacturers must now begin reporting actively exploited vulnerabilities and severe incidents to ENISA’s single reporting platform and the relevant national CSIRT. 

Actively exploited vulnerabilities are flaws in products with digital elements that are being exploited by malicious actors without owner consent. Routine bugs or vulnerabilities patched before exploitation are not in scope. 

Severe incidents are events that negatively affect, or could negatively affect, the product’s ability to maintain availability, authenticity, integrity, or confidentiality of data or functions.

Importantly, reporting obligations apply to products already on the EU market if the product is still within the declared support period.

Per Article 24(3) of the CRA, open-source software stewards — entities responsible for the security, maintenance, and distribution of free and open‑source software  — are subject to reporting obligations from December 11, 2027.

Strict reporting timelines

To maintain compliance, organizations must adhere to four strict reporting windows:

• 24 Hours: Early warning notification of an actively exploited vulnerability or severe incident.
• 72 Hours: Comprehensive update containing initial assessment details.
• 14 Days: Final report following corrective or mitigating measures for actively exploited vulnerabilities.
• 1 Month: Final report following the 72-hour submission for severe incidents. 

Non-compliance penalties for reporting failure 

Failure to report exploitable vulnerabilities can result in fines up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.

Dual Compliance Tip: Learn how to align NIS2 and CRA requirements in our comprehensive guide. Read the guide.

Actionable tactics to prepare today

Integrating CRA obligations into your existing risk management framework requires proactive vulnerability identification, robust security controls, and rapid incident response workflows.

Key tactics for immediate implementation include:

• Maintain threat awareness channels: Establish clear intake channels for customers and research partners to report vulnerabilities. Continuously monitor zero-day intelligence feeds.
• Ensure supply chain visibility: Modern digital products depend on third-party libraries, firmware, and cloud services. Map vendor dependencies to identify upstream risks.
• Maintain Software Bills of Materials (SBOMs): While SBOM-level mandates are not required by CRA until December 2027, maintaining SBOMs now is critical for rapid vulnerability tracing. You cannot report on what you cannot see.
• Refine incident report procedures: Update existing response workflows with clear triggers, defined thresholds, and assigned owners for ENISA notifications.
• Test reporting workflows: Simulate ENISA platform reporting scenarios to ensure your team can execute submissions within 24-hour and 72-hour windows. 

Strategic preparedness with Hyperproof

Many technical controls and documentation practices required by the CRA overlap with established frameworks like ISO 27001, NIS2, and GDPR. Rather than managing regulations in silos, leading organizations adopt a unified compliance operations model.

Hyperproof streamlines CRA compliance with these key capabilities:

• Map once, apply everywhere: Hyperproof features the largest pre-built framework library on the market. Through the Hyperproof Crosswalk and Jumpstart capabilities, requirements from our 160+ framework programs are mapped across nearly 2,500 domains to eliminate duplicate controls.
• Granular ownership across products: Hyperproof’s Hierarchical Scopes help organizations manage applicable requirements across multiple products. Product line teams receive autonomous control ownership, managing their specific scope, attaching proof, and tracking status. 

Request a demo to see how Hyperproof can help your team streamline CRA compliance.