CRA Reporting Is Live: What Manufacturers, Vendors, and Distributors Need to Know

Article 14 of the EU Cyber Resilience Act (CRA) took effect on September 11, 2026, requiring manufacturers, importers, and distributors of products with digital elements sold into the EU to notify ENISA or their national CSIRT within 24 hours of learning a vulnerability is being actively exploited, with a mitigation report due in 72 hours and full analysis within two weeks. ENISA clarified the obligation applies only to vulnerabilities actively exploited within a manufacturer's own product, not anywhere in the supply chain. Non-compliance penalties can reach 2.5% of global turnover or 15 million euros. The piece covers scope (four criticality tiers, exclusions for open source and hosted services), the limits of public vulnerability data (NVD scoring gaps, EU Vulnerability Database mirroring NVD), the need for automated continuous monitoring and CVSS v4 scoring, SBOM obligations across supply chains, AI's dual role as both attack surface expander and assessment aid (with the caveat that non-deterministic AI output doesn't satisfy CRA's documented, repeatable evidence requirements), and the upcoming December 2027 secure development lifecycle obligations plus the related EU Product Liability Directive.

Source: https://www.itsecurityguru.org/2026/09/23/cra-reporting-is-live-what-manufacturers-vendors-and-distributors-need-to-know. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.