In short
Since 11 September 2026 manufacturers report actively exploited vulnerabilities and severe incidents through the ENISA single platform.
The early warning is due within 24 hours, the notification within 72 hours, followed by a final report.
The reporting obligation also covers products already on the market before 2027.
From 11 December 2027 the whole regulation applies: risk assessment, support period, SBOM, technical documentation and CE marking.
In Italy the draft decree designating the ACN as market surveillance authority is still under review.
Since 11 September 2026, manufacturers of software and of products with digital elements sold in the European Union must report actively exploited vulnerabilities and severe incidents affecting their products. This is required by Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, and on the same day ENISA launched the single reporting platform. The rest of the regulation applies from 11 December 2027.
In the meantime, on 27 July 2026, the European Commission published its first guidance on applying the regulation. In Italy, on 2 October 2026, the Council of Ministers gave preliminary approval to the draft legislative decree that designates the National Cybersecurity Agency (ACN) as the market surveillance authority. This guide covers what the law requires today, who is affected and a checklist to help you be ready for 2027. It is not legal advice: if you have doubts about your case, check it with a lawyer or an experienced consultant.
What changed on 11 September 2026 with the Cyber Resilience Act?
The manufacturers' reporting obligation became applicable. Article 71 of the regulation sets full application at 11 December 2027, but brings Article 14 forward to 11 September 2026. Since then, if a manufacturer becomes aware of an actively exploited vulnerability or a severe incident having an impact on the security of its product, it must notify it within set deadlines.
Actively exploited vulnerability and severe incident: what they mean
The regulation does not require every flaw to be reported. An actively exploited vulnerability is one for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission (Article 3, point 42). A vulnerability found in an internal test and never exploited does not fall under this obligation, although it still has to be handled.
An incident having an impact on the security of the product is considered severe if it affects, or is capable of affecting, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions. It is also severe if it has led, or is capable of leading, to malicious code being run in the product or in a user's systems (Article 14(5)).
The obligation also covers products already on sale
This is the point that surprises people most. As a rule, products placed on the market before 11 December 2027 are subject to the regulation only if they undergo a substantial modification. Article 69(3), however, makes an exception: the reporting obligations in Article 14 apply to all products within the scope of the regulation, including those already on the market. If you have been selling a connected product for years, the obligation covers it too.
How reporting works: deadlines, recipients and the single platform
Notifications must be sent simultaneously to the CSIRT designated as coordinator and to ENISA, the European Union Agency for Cybersecurity. They are not sent by email: they go through the single reporting platform provided for in Article 16 and run by ENISA.
The deadlines set by Article 14
The regulation sets out three successive steps, with different timings for vulnerabilities and incidents. Deadlines run from the moment the manufacturer becomes aware of the issue.
Step | Actively exploited vulnerability | Severe incident |
|---|---|---|
Early warning | without undue delay and in any event within 24 hours | without undue delay and in any event within 24 hours, stating whether an unlawful or malicious act is suspected |
Notification | within 72 hours, with general information on the product, the nature of the exploit and the corrective or mitigating measures | within 72 hours, with the nature of the incident, an initial assessment and the measures taken |
Final report | within 14 days after a corrective or mitigating measure is available | within one month after the incident notification |
In the early warning, the manufacturer states, where applicable, the Member States in which it knows the product has been made available. The CSIRT that first receives the notification may also ask for an intermediate report. The regulation also provides for voluntary reporting (Article 15) of non-exploited vulnerabilities, threats and near misses.
Which CSIRT receives the notification
The notification goes through the endpoint of the CSIRT designated as coordinator in the Member State where the manufacturer has its main establishment in the Union, meaning where decisions on the cybersecurity of its products are predominantly taken (Article 14(7)). For a manufacturer whose decision-making base is in Italy, the ENISA list of CSIRTs designated as coordinators under the regulation points to CSIRT Italia at the ACN.
ENISA launched the platform on 11 September 2026 and has published FAQs, user manuals and registration guides. According to the Agency's page, the platform was upgraded to version 1.3 on 4 November 2026: it is worth registering early, before you need it, and checking the updated documentation regularly.
Informing users
Reporting to the authorities is not enough. Once aware of an actively exploited vulnerability or a severe incident, the manufacturer informs the affected users and, where necessary, explains the measures they can take to mitigate the impact (Article 14(8)). If the manufacturer does not do so in a timely manner, the CSIRT may inform users directly.
Who is affected by the Cyber Resilience Act?
The regulation applies to products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2). The definition covers software and hardware products, their components placed on the market separately and their remote data processing solutions.
Manufacturers
A manufacturer is anyone who develops or manufactures a product with digital elements, or has it designed and manufactured, and markets it under its own name or trademark, whether for payment, monetisation or free of charge (Article 3, point 13). The reporting obligations in Article 14 apply to manufacturers.
Watch out for Articles 21 and 22 too: an importer or distributor that places a product on the market under its own trademark, or anyone who makes a substantial modification to a product already on the market and makes it available, is considered a manufacturer and takes on the same obligations.
Importers and distributors
Importers place only compliant products on the market: beforehand they check the conformity assessment, the technical documentation, the CE marking and the instructions (Article 19). Distributors check the CE marking and the documentation they receive (Article 20). Both inform the manufacturer without undue delay when they become aware of a vulnerability.
Open-source software stewards
The regulation introduces the open-source software steward: a legal person, other than a manufacturer, that provides systematic and sustained support for the development of free and open-source software intended for commercial activities (Article 3, point 14). Stewards have lighter obligations: a documented cybersecurity policy and cooperation with the authorities (Article 24). According to ENISA, the reporting obligations for stewards apply from 11 December 2027.
Important and critical products
Annex III of the regulation lists important products, split into two classes. Class I includes, for example, operating systems, browsers, password managers, VPNs, routers, SIEM systems and smart home products with security functions. Class II includes, for example, firewalls, intrusion detection and prevention systems and hypervisors. Annex IV lists critical products, such as smartcards and secure elements. In November 2025 the Commission adopted an implementing act with the technical descriptions of these categories.
Classification matters for the conformity assessment: for products that are neither important nor critical, the manufacturer may also choose the internal control procedure, while for important and critical products the regulation sets stricter procedures (Articles 7, 8 and 32). Some products are excluded because they are governed by other rules, such as medical devices.
What changes from 11 December 2027?
From that date the whole regulation applies. A product with digital elements may be made available on the market only if it meets the essential cybersecurity requirements of Annex I and if the manufacturer's processes meet the vulnerability handling requirements (Article 6).
The manufacturer's main obligations
Article 13 requires the manufacturer to carry out a cybersecurity risk assessment, document it and take it into account at every stage, from design to maintenance. It must also exercise due diligence on third-party components, including open-source ones.
The manufacturer must then set a support period, during which it handles the product's vulnerabilities. The period reflects the expected time of use and is at least five years, unless the product is expected to be in use for less time: in that case it matches the expected time of use. Each security update remains available for at least ten years after release or for the remainder of the support period, if longer. The end date of the support period must be clearly stated at the time of purchase.
Vulnerability handling and the software bill of materials
Annex I, Part II, lists the vulnerability handling requirements. The manufacturer identifies and documents vulnerabilities and components in the product, including by drawing up a software bill of materials (SBOM) in a commonly used, machine-readable format covering at least the top-level dependencies. It must also remediate vulnerabilities without delay, test security regularly, adopt a coordinated vulnerability disclosure policy, provide a contact address for reports and distribute updates securely and free of charge.
Technical documentation and CE marking
Before placing a product on the market, the manufacturer draws up the technical documentation (Article 31 and Annex VII): product description, architecture, vulnerability handling processes, risk assessment, information used to set the support period, standards applied and test reports. It then follows the conformity assessment procedure, draws up the EU declaration of conformity and affixes the CE marking. The documentation and declaration remain available for at least ten years or for the support period, if longer.
What does the Commission's July 2026 guidance say?
On 27 July 2026 the Commission published its first guidance on applying the Cyber Resilience Act (document C(2026) 5252). The Commission describes it as non-binding but useful for preparing now.
According to the official page, the document clarifies the scope, with particular attention to remote data processing solutions and free and open-source software. It also covers the concept of substantial modification, support periods, reporting obligations and risk assessment. For micro-enterprises and SMEs it includes 67 examples, use cases, flowcharts and graphs. The Commission also keeps a frequently asked questions document on implementation up to date.
If your product sits on the edge of the scope, for example software with a cloud component or a device that receives updates, the guidance is the first document to read after the text of the regulation.
Where does the Italian decree on the Cyber Resilience Act stand?
The regulation is directly applicable, but each Member State must designate its market surveillance authorities (Article 52) and lay down the rules on penalties. In Italy, the Council of Ministers meeting no. 191 of 2 October 2026 gave preliminary approval to the legislative decree adapting national law to the regulation.
According to the Government's press release, the draft decree designates the ACN as the authority for notifying conformity assessment bodies and for market surveillance, with possible support from the Guardia di Finanza. It also provides for a dedicated advice channel for micro-enterprises and SMEs, including start-ups, proportionate fees for conformity assessment, a regulatory sandbox (Sandbox-CRA) supervised by the ACN and administrative penalties graded according to the seriousness of the breach.
As of 12 November 2026 the Government's website shows no final approval and the decree has not been published in the Gazzetta Ufficiale: it is a draft under review, which may change during the process. The reporting obligations, on the other hand, stem from the EU regulation and already apply. If you operate outside Italy, check the status with your own national authorities.
Checklist: what software and connected device manufacturers should do today
Here are the practical steps to start now, in order of priority. They do not replace reading the regulation and the guidance, but they help you see where the gaps are.
1. Take stock of your products
List all the software and hardware products you make available in the Union, including free ones, those sold for years and those with cloud components. For each one, note supported versions, countries of sale, third-party and open-source components and update channels. You need this to know which products are already covered by the reporting obligation.
2. Classify role and category
For each product, clarify your role: manufacturer, importer, distributor or open-source software steward. Check whether the product falls into a category in Annex III or IV, whether it is excluded because it is governed by other rules and whether a change you make could be substantial. The Commission's guidance helps in borderline cases.
3. Set up the reporting procedure
Write a procedure that states who decides, who assesses whether a vulnerability is actively exploited or an incident is severe, who sends the early warning, notification and final report, and who informs users. Register your company on the ENISA single platform, identify the competent CSIRT and run a mock notification with your team. The 24 hours start from awareness of the event, even at night or at the weekend.
4. Structure vulnerability handling and coordinated disclosure
Publish a contact point for vulnerability reports and a coordinated disclosure policy. Define how you receive, assess, fix and communicate vulnerabilities, including in third-party components. Plan regular security testing: to understand the difference between the tools, read the guide on penetration testing and vulnerability assessment and the one on WAPT for web applications.
5. Prepare the software bill of materials
Start generating a machine-readable SBOM for every release, covering at least the top-level dependencies. It already helps you work out within hours whether a vulnerability exploited in a component affects your products, and from 2027 it is a requirement of the regulation.
6. Start the technical documentation
Set up a technical documentation template for each product based on Annex VII: risk assessment, architecture, vulnerability handling processes, support period and test reports. Keep it up to date with every release.
7. Plan the road to 2027
Draw up a plan with owners and deadlines up to 11 December 2027: secure design, support period, free updates, conformity assessment, EU declaration and CE marking. For an overview of the dates, read the guide on compliance deadlines for 2026-2027.
How does the Cyber Resilience Act relate to ISO 27001 and NIS2?
They are different rules, but they work well together. The Cyber Resilience Act covers the security of the products you place on the market; the NIS2 Directive covers the security of the networks and systems of certain organisations; ISO 27001 is a voluntary standard for information security management systems.
An ISO 27001 management system already gives you a solid foundation: risk assessment, incident management, supplier management, change control, documentation and continual improvement. It does not replace the regulation's product requirements, but it makes them easier to apply methodically. To find out more, read the complete guide to ISO 27001 and the one on ISO 27001 and NIS2.
If your company also falls under NIS2, the obligations add up: Cyber Resilience Act notifications concern products, NIS2 notifications concern incidents affecting your services. For the basic measures to start from, even if you are not subject to NIS2, read the guide on minimum cybersecurity measures for SMEs.
How Complaion helps you with information security and compliance
Complaion supports companies with information security and regulatory compliance: ISO 27001 certification, NIS2 compliance, Cyber Resilience Act projects and security testing through the WAPT service.
A dedicated Lead Auditor follows your company, analyses your starting point and proposes the most suitable path. The platform collects evidence, manages documents and procedures, keeps track of deadlines and prepares you for the audit. The Lead Auditor also conducts the internal audit, so you know whether your processes really work before external checks.
More than 1,000 clients have already chosen Complaion. If you want to know where to start, contact us.
Frequently asked questions about the Cyber Resilience Act
Since when do I have to report actively exploited vulnerabilities?
Since 11 September 2026, if you are a manufacturer of products with digital elements. The obligation also covers products already on the market before 11 December 2027 (Article 69(3)). The early warning must be sent within 24 hours of becoming aware, through the ENISA single reporting platform.
Do I have to report every vulnerability I find?
No. The obligation concerns actively exploited vulnerabilities, meaning those with reliable evidence of malicious exploitation, and severe incidents. Other vulnerabilities must still be handled and fixed according to your policy, and can be reported on a voluntary basis.
Who receives the notification?
The notification is sent through the ENISA single platform, selecting the CSIRT designated as coordinator of the Member State where you have your main establishment. For Italy, the ENISA list points to CSIRT Italia at the ACN. The notification is made available to ENISA at the same time.
Does the Cyber Resilience Act also cover free software?
The definition of manufacturer also includes those who market products free of charge or for monetisation. For free and open-source software, the situation depends on the commercial context: the Commission's guidance devotes a section to this very topic. If your case is unclear, check it with a consultant.
Does the support period have to be five years?
The regulation requires it to reflect the product's expected time of use and sets at least five years, unless the product is expected to be in use for less time: in that case it matches the expected time of use. This obligation applies from 11 December 2027.
Is the Italian decree on the Cyber Resilience Act already in force?
No. On 2 October 2026 the Council of Ministers gave it preliminary approval, and as of 12 November 2026 it has not been published in the Gazzetta Ufficiale. The draft designates the ACN as the market surveillance authority and sets out national penalties. The reporting obligations in Article 14, however, stem directly from the EU regulation and already apply.
