Cyber Resilience Act: reporting obligations now apply

2026-09-11 · Publisher : Union européenne · Domain : Industry 4.0 & 5.0

Since 11 September 2026, makers of products with digital elements, including PLCs and industrial software, must report actively exploited vulnerabilities and severe incidents (CRA Article 14), with an early warning within 24 hours.

### What changes Since 11 September 2026, **Article 14** of the Cyber Resilience Act (Regulation (EU) 2024/2847) applies: any manufacturer of a product with digital elements must report **actively exploited vulnerabilities** and **severe incidents** having an impact on the security of the product. Notifications go simultaneously to the CSIRT designated as coordinator and to ENISA, through the single reporting platform. The text sets three steps: early warning within **24 hours**, notification within **72 hours**, then a final report (14 days after a corrective measure is available for a vulnerability, one month after the notification for an incident). ### Timeline - **10 December 2024**: the regulation enters into force. - **27 July 2026**: the Commission publishes practical guidance on these obligations. - **11 September 2026**: Article 14 applies, including to products already on the market (Art. 69). - **11 December 2027**: full application (essential requirements, technical documentation, CE marking). ### Why it matters PLC, HMI, gateway or engineering software makers: the duty lies with the manufacturer, whatever its size. It takes an escalation chain able to meet the 24-hour deadline, including outside business hours, monitoring of vulnerabilities across the installed base and aligned supplier contracts. On the plant side, operators can expect faster and better documented security advisories on their equipment. ### Key takeaway The first operational part of the CRA is live fifteen months before CE marking: vulnerability handling becomes a legal obligation, not just good practice.

Tags : Réglementation, UE, Cybersécurité OT, CRA, Vulnérabilités