CRA Reporting Readiness Check
CRA reporting duties apply from 11 Sep 2026 — including products already on the market. Are your 24h processes ready?
The Cyber Resilience Act obliges manufacturers of products with digital elements (including pure software) to report actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours — via the ENISA reporting platform. This check tests whether your organization can deliver that from 11 Sep 2026. Non-binding first assessment — no legal advice.
Non-binding first assessment — no legal advice, no proof of compliance.
Frequently asked questions
When do the CRA reporting duties apply?
The CRA reporting duties apply from 11 Sep 2026 — including products already on the market. The main duties (essential requirements, conformity assessment, CE marking) follow from 11 Dec 2027.
Which deadlines do I have to meet?
Early warning within 24 hours, notification within 72 hours, final report after 14 days (vulnerability) or 1 month (incident) — via the ENISA Single Reporting Platform to the competent CSIRT (DE: BSI).
Who has to report?
The Cyber Resilience Act obliges manufacturers of products with digital elements (including pure software) — not the operator. Micro/small enterprises are only exempt from fines for late 24h early warnings, not from the reporting duty itself.
What does this readiness check assess?
The check assesses in 10 questions (approx. 3 minutes) whether your organisation can deliver the 24h/72h reporting chain: product inventory, PSIRT process, reporting chain, SBOM & update process and ownership. Non-binding first assessment — no legal advice.