{"id":35316,"date":"2026-10-07T00:00:21","date_gmt":"2026-10-06T22:00:21","guid":{"rendered":"https:\/\/www.proactivanet.com\/?p=35316"},"modified":"2026-10-07T09:35:26","modified_gmt":"2026-10-07T07:35:26","slug":"cyber-resilience-act","status":"publish","type":"post","link":"https:\/\/www.proactivanet.com\/en\/blog\/security\/cyber-resilience-act\/","title":{"rendered":"Cyber Resilience Act: what changes with the obligation to report vulnerabilities"},"content":{"rendered":"

The Cyber Resilience Act<\/strong> is no longer a distant regulation. Since 11 September 2026, manufacturers of products with digital elements sold in the European Union must report actively exploited vulnerabilities and severe incidents within 24 hours.<\/p>\n

It is the first obligation of the regulation that is already enforceable, and it arrives more than a year before full application. In this article we review what changes, who is affected (Spain, Mexico, Colombia, Peru and Chile), which deadlines apply and why the starting point is always the same: knowing exactly what technology you have and where it is.<\/p>\n

What is the Cyber Resilience Act?<\/h2>\n

The Cyber Resilience Act (CRA) is Regulation (EU) 2024\/2847. It sets common cybersecurity requirements for every product with digital elements placed on the EU market, whether software or connected hardware.<\/p>\n

Its underlying idea is that security should be part of the product from design and throughout its lifecycle, rather than depending on after-the-fact patches. It applies in stages:<\/p>\n

\n\n\n\n\n\n\n\n
Date<\/th>\nMilestone<\/th>\n<\/tr>\n<\/thead>\n
10 December 2024<\/td>\nEntry into force of the regulation<\/td>\n<\/tr>\n
11 September 2026<\/td>\nObligation to report exploited vulnerabilities and severe incidents (Article 14)<\/td>\n<\/tr>\n
11 December 2027<\/td>\nFull application of the remaining requirements, including CE marking<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

What changes from 11 September 2026<\/h2>\n

Article 14<\/a> requires manufacturers to report two things: any vulnerability in their product that is being actively exploited, and any severe incident affecting its security.<\/p>\n

The notification goes simultaneously to ENISA and to the coordinating CSIRT of the country where the manufacturer has its main establishment. In Spain, that CSIRT is INCIBE-CERT. There is a single channel: the Single Reporting Platform (SRP) managed by ENISA, operational from that same date.<\/p>\n

Reporting deadlines<\/h3>\n
\n\n\n\n\n\n\n\n\n
Deadline<\/th>\nWhat must be sent<\/th>\n<\/tr>\n<\/thead>\n
24 hours<\/td>\nEarly warning from the moment of awareness<\/td>\n<\/tr>\n
72 hours<\/td>\nNotification with the information available<\/td>\n<\/tr>\n
14 days<\/td>\nFinal report on an exploited vulnerability<\/td>\n<\/tr>\n
1 month<\/td>\nFinal report on a severe incident<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

In addition, the manufacturer must inform affected users and, where appropriate, indicate measures to mitigate the risk.<\/p>\n

What the Cyber Resilience Act does not yet require (and who it affects)<\/h2>\n

The scope of this first phase is narrower than it seems. On 27 July 2026 the European Commission published a first interpretative guidance<\/a> clarifying several points:<\/p>\n