Article · November 4, 2026
Cyber Resilience Act: 24-Hour Reporting Is Now Live
CRA timeline, ENISA reporting duties from Sept 2026, roles of ANSSI and ANFR, harmonised standards, and an actionable roadmap for manufacturers.
The Cyber Resilience Act (Regulation (EU) 2024/2847) has entered its operational phase. Since September 11, 2026, any manufacturer of a product with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents. Security-by-design requirements will become mandatory on December 11, 2027.
The CRA in One Sentence
The CRA establishes a common cybersecurity baseline for all digital products—both hardware and software—throughout their entire lifecycle, ultimately leading to CE marking. Fines can reach up to €15 million or 2.5% of global annual turnover, whichever is higher (Jones Day).
According to ANSSI Director General Vincent Strubel, "the CRA is the digital equivalent of barrier gestures in public health" (ANSSI).
The Timeline
| Date | Milestone |
|---|---|
| October 10, 2024 | Formal adoption by Parliament and Council |
| December 10, 2024 | Entry into force |
| April 2025 | CEN, CENELEC, and ETSI accept Standardisation Request M/606: approximately 41 harmonised standards, including 15 horizontal standards |
| June 11, 2026 | Rules for conformity assessment bodies apply |
| July 27, 2026 | Publication of Commission guidelines (over 80 pages, non-binding) |
| September 11, 2026 | Reporting obligations (Article 14) apply and ENISA platform opens |
| October 31, 2026 | Revised delivery deadline for two key horizontal standards (secure development, vulnerability handling) |
| December 31, 2026 | Revised delivery deadline for vertical product-specific standards |
| December 11, 2027 | Full application: essential requirements and CE marking |
Sources: cyberresilienceact.eu, Jones Day.
Reporting: Three Deadlines to Meet
All notifications must be submitted through ENISA's Single Reporting Platform (SRP), accessible at portal.cra-srp.enisa.europa.eu. A single submission is transmitted simultaneously to both ENISA and the coordinating CSIRT (cyberresilienceact.eu). The clock starts as soon as the manufacturer becomes aware of the event:
| Stage | Deadline |
|---|---|
| Early warning | 24 hours |
| Notification | 72 hours |
| Final report (exploited vulnerability) | 14 days after a corrective patch is made available |
| Final report (severe incident) | 1 month following the 72-hour notification |
According to Commission guidelines, a manufacturer "becomes aware" of an event when an initial analysis provides reasonable certainty that active exploitation or a severe incident has occurred. No retroactive reporting is required for exploitation identified prior to September 11, 2026.
However, the obligation also applies to products placed on the market before December 2027, and impacted users must be notified (Jones Day).
How Domyno helps
One source of truth, agents that prepare the work, and a dedicated expert who reviews it.
Market Surveillance and Enforcement in France
The French National Frequency Agency (ANFR) serves as the market surveillance authority: it inspects products and can order market withdrawals or issue financial penalties. ANSSI serves as the notifying authority, responsible for evaluating and supervising conformity assessment bodies, as well as the national CSIRT designated under the CRA (ANSSI).
Harmonised Standards: Still Under Construction
A product that conforms to a harmonised standard benefits from a presumption of conformity, but only once that standard is cited in the Official Journal of the European Union. As of the latest update consulted (September 2026), no CRA standard had yet been cited.
A draft amendment from July 2026 pushed delivery deadlines back by two months, and ETSI launched a public enquiry on August 13, 2026, for 17 draft product standards (EN 304 xxx series) (cyberresilienceact.eu). Manufacturers must therefore begin working immediately using existing draft standards.
What to Do Now
- Inventory your products and classify them (default, Important Class I or II, Critical): this classification determines the required conformity assessment procedure.
- Implement a 24/7 capability to detect and triage actively exploited vulnerabilities.
- Create your account on ENISA's SRP platform and identify your coordinating CSIRT.
- Generate and maintain a Software Bill of Materials (SBOM) for every product.
- Require component suppliers to share their CRA compliance roadmaps.
- Begin preparing the technical documentation required for December 2027 today.
How Domyno Supports You
Domyno is an enterprise-grade compliance platform designed to adapt to your organization rather than forcing you into a rigid model. Are harmonised CRA standards still pending official publication? With our custom framework feature, you can build your internal CRA baseline today from the regulation's essential requirements and update it as standards are published.
The control plan converts these requirements into concrete tasks: each control is assigned an owner, a deadline, and required evidence. Our asset, vulnerability, and incident management modules provide the operational foundation needed to run your 24-hour and 72-hour reporting workflows, while vendor management features help you track CRA roadmaps across third-party components.
Domyno's AI assists your teams daily, backed by dedicated compliance experts at every step. One single platform for CRA, ISO 27001, NIS2, DORA, and all your security frameworks.