Cyber Resilience Act Reporting Obligations: What Manufacturers Need to Know
This article examines the reporting obligations established under Article 14 of the EU Cyber Resilience Act (CRA), including the distinction between actively exploited vulnerabilities and severe security incidents, the applicable reporting timelines, when the reporting clock begins, and manufacturers’ responsibilities for vulnerabilities involving third-party components.
This article was written by an SRES cybersecurity and functional safety expert with extensive experience supporting OEMs, Tier 1/2 suppliers, and autonomous-system developers across safety-critical automotive systems, cybersecurity, functional safety, and autonomy development.
Looking to go deeper? Explore SRES’ EU Cyber Resilience Act (CRA) Training. Need support beyond training? Contact SRES at info@sres.ai to discuss consulting support for vulnerability reporting, incident response, and cybersecurity compliance processes.
Introduction
As of September 11, 2026 the reporting obligations under Article 14 of the EU Cyber Resilience Act (CRA) are legally binding.
Manufacturers of products with digital elements must now report Actively Exploited Vulnerabilities (AEVs) and severe incidents within defined timelines.
The key question for manufacturers is no longer understanding the CRA, it is whether their process can identify and report actively exploited vulnerabilities within 24 hours.
1. What Must Be Reported Under the CRA?
Article 14 establishes reporting obligations for two primary cybersecurity events:
- Actively Exploited Vulnerabilities (AEVs)
- Severe incidents having an impact on the security of the product with digital elements
Understanding the difference between the two events is important because not every vulnerability or cybersecurity event automatically triggers a CRA reporting obligation.
Actively Exploited Vulnerability
The CRA regulation defines three different types of vulnerabilities
- ‘Vulnerability’ means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat.
- ‘Exploitable vulnerability’ means a vulnerability that has the potential to be effectively used by an adversary under practical operational conditions.
- ‘Actively exploited vulnerability’ means a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner.
The CRA requires the reporting only for actively exploited vulnerabilities. In other words, simply discovering a vulnerability does not automatically make it reportable under Article 14.
For example, a vulnerability identified during an internal penetration test will require investigation and remediation, but it would not necessarily qualify as an actively exploited vulnerability if there is no reliable evidence of malicious exploitation.
What needs to be reported? If a manufacturer receives credible evidence that an attacker is exploiting a vulnerability.
Manufacturers may receive evidence from multiple sources such as an Intrusion Detection System (IDS), customer report, security researcher, or suppliers.
Organizations need more than a vulnerability management system. They also need a clear method for determining when information about a vulnerability becomes evidence of an active exploitation.
Severe Security Incident
The second reporting category covers severe incidents affecting the security of a product with digital elements. Article 3 of the CRA defines an ‘incident having an impact on the security of the product with digital elements’ as an incident that negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of data or function.
Organizations need clear internal criteria for distinguishing between a cybersecurity event and a severe incident that meets the CRA’s severe incident reporting threshold. In general, an incident may meet this threshold if it:
- It negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions
- It has led or is capable of leading to the introduction or execution of malicious code in a product with digital elements or in the network and information systems of a user of the product with digital elements.
2. Understanding the CRA Reporting Timeline
Once a manufacturer becomes aware of an actively exploited vulnerability or severe incident, the reporting process moves quickly.
| Reporting Stage | Deadline | Detail |
|---|---|---|
| Early Warning | Within 24 hours of becoming aware | Initial awareness of the event |
| Notification | Within 72 hours of becoming aware | Provide additional information and an initial assessment |
| Final Report (Actively Exploited Vulnerability) | Within 14 days after a corrective or mitigating measure becomes available | Contains more complete information once the investigation and response have progressed. |
| Final Report (Severe Incident) | Within one month after the 72 hour notification report |
3. When Does The 24-Hour CRA Reporting Clock Start
The key concept is awareness. The 24-hour and 72-hour reporting periods begin when the manufacturer becomes aware of the actively exploited vulnerability or severe incident.
Consider the following scenario:
A customer reports a suspicious product behavior on Tuesday at 4:00 pm, the security engineer reviews the issue on Wednesday 9:00 am and by 10:00 am determines it is in fact an actively exploited vulnerability. When does the 24-hour clock start?
Assuming the customer report did not itself provide reliable evidence of malicious exploitation, the clock would start at 10:00 a.m. Wednesday, when the manufacturer established that the vulnerability was being actively exploited.
4. What about Third-Party Components?
Modern digital products often depend on operating systems, open-source libraries, communication stacks, and other third-party components.
Manufacturers remain responsible for the overall security of their products, including vulnerabilities introduced through integrated third-party components. If a manufacturer detects an actively exploited vulnerability in a third-party component, it remains responsible for addressing that vulnerability in its product.
5. Is Your Organization Ready for CRA Reporting?
The CRA reporting obligations require more than understanding Article 14. Manufacturers need clear processes to identify reportable events, assess their impact, escalate them internally, and submit the required information within the applicable deadlines.
Need Support Preparing for CRA Reporting?
Organizations subject to the Cyber Resilience Act need clear processes for identifying reportable events, evaluating available evidence, escalating incidents, and meeting the applicable reporting deadlines.
Explore SRES’ EU Cyber Resilience Act (CRA) Training to help your team understand how the regulation translates into practical engineering and product-development activities. For consulting support with CRA readiness, vulnerability reporting, incident response, or related cybersecurity processes, contact SRES at info@sres.ai.
Have insights or questions? Send us an email at info@sres.ai or leave a comment below. We welcome thoughtful discussion from our technical community.
Interested in learning more about our approach? Explore why teams choose SRES training and how we support organizations with Automotive consulting and Physical AI consulting.
