Cyber Resilience Act: The Reporting Clock Starts on 11 September — What Software Vendors Must Do Now

The Cyber Resilience Act has so far been a date on the horizon for most software companies: December 2027, when CE marking and the full catalogue of security requirements apply. That framing is now outdated. On 11 September 2026, the first operative obligation starts — mandatory reporting of actively exploited vulnerabilities and severe incidents, with a first deadline of 24 hours.

Regulation (EU) 2024/2847 establishes horizontal cybersecurity requirements for products with digital elements placed on the EU market — hardware and software alike. It entered into force in December 2024 and applies in stages. The reporting obligations are the first stage that affects manufacturers directly, and they apply to all products on the market, including those placed on the market long before the regulation existed.

Who Is Covered — and What About SaaS?

The CRA covers products with digital elements: installable software, mobile and desktop apps, firmware, libraries and SDKs supplied commercially, browser extensions, and connected devices. Remote data processing is covered only where it is an integral part of such a product — the cloud backend without which a device or app cannot perform its functions.

Pure SaaS delivered entirely through the browser is generally outside the CRA; it falls under NIS2 where size and sector thresholds are met, and under DORA-driven contractual requirements where the customers are financial entities. But few SaaS vendors are pure: a mobile app, a desktop sync client, an on-premise agent, or an SDK for customers' developers brings the company into scope as a manufacturer for exactly those components.

The Reporting Obligations From 11 September 2026

• What: actively exploited vulnerabilities in the product and severe incidents affecting its security.
• Early warning: within 24 hours of becoming aware.
• Notification: within 72 hours, with an initial assessment and mitigation information.
• Final report: for vulnerabilities, within 14 days after a corrective measure is available; for severe incidents, within one month.
• Channel: ENISA's Single Reporting Platform, routed to the CSIRT of the member state where the manufacturer has its main establishment.
• Users: affected users must be informed about the vulnerability or incident and about corrective measures.

“

Twenty-four hours is not a documentation deadline. It is an operational one — it only works if detection, triage, and escalation are already wired together.

Why the Short Deadline Is Hard in Practice

The clock starts when the manufacturer becomes aware — not when the analysis is complete. Many companies discover exploited vulnerabilities through a customer ticket, a researcher's e-mail, or a threat intelligence feed that lands in a shared inbox. Without a defined intake, a named on-call function, and pre-authorised escalation, 24 hours pass before anyone with decision authority has read the message. Vendors with customers in the financial sector face a second layer: those customers have their own DORA incident timelines and will expect to hear from their supplier at least as fast.

Penalties and the Road to 2027

Infringements of the core obligations can lead to fines of up to EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher. The reporting stage is also a dress rehearsal: from 11 December 2027, products must meet the essential cybersecurity requirements, carry CE marking, come with a defined support period for security updates, and — for important and critical product categories — undergo stricter conformity assessment.

A Readiness Checklist

1. 01Inventory every product component shipped to customers — apps, clients, agents, SDKs — and determine where you act as manufacturer.
2. 02Establish a coordinated vulnerability disclosure policy and a single, monitored intake channel for vulnerability reports.
3. 03Define an on-call triage role with authority to classify “actively exploited” and trigger the 24-hour warning.
4. 04Register access to ENISA's Single Reporting Platform and prepare notification templates in advance.
5. 05Maintain software bills of materials, so exploited third-party components can be traced to affected products within hours.
6. 06Align CRA reporting with NIS2 and customer-facing DORA notifications — one incident process, several outputs.

Conclusion

The Cyber Resilience Act starts not with paperwork but with a stopwatch. Software vendors that treat 11 September 2026 as an operational go-live — intake, triage, escalation, reporting — will meet the deadline and gain credibility with regulated customers. Aegiron Capital Group supports software and fintech companies in positioning their security and compliance processes for the DACH market; legal advice and security assessments come from the law firm and specialists you engage.