{"id":13987,"date":"2026-09-03T08:59:32","date_gmt":"2026-09-03T06:59:32","guid":{"rendered":"https:\/\/cybrela.com\/?p=13987"},"modified":"2026-09-14T10:06:27","modified_gmt":"2026-09-14T08:06:27","slug":"reporting-obligation-cra","status":"publish","type":"post","link":"https:\/\/cybrela.com\/en\/oznamovaci-povinnost-cra\/","title":{"rendered":"CRA reporting obligations: what must you report from September 11th 2026?"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"13987\" class=\"elementor elementor-13987\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7d302fe0 e-con-full e-flex e-con e-parent\" data-id=\"7d302fe0\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[]}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b94fd10 elementor-widget elementor-widget-post-info\" data-id=\"b94fd10\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"post-info.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-inline-items elementor-icon-list-items elementor-post-info\">\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-898dc3a elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-user\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-custom\">\n\t\t\t\t\t\t\t\t\t\tPetra Jiro\u0161ov\u00e1\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-5622694 elementor-inline-item\" itemprop=\"datePublished\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-calendar-alt\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-date\">\n\t\t\t\t\t\t\t\t\t\t<time>3. September 2026<\/time>\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-c750f0b elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"far fa-clock\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-custom\">\n\t\t\t\t\t\t\t\t\t\t13 min read\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d5420dd e-con-full e-flex e-con e-child\" data-id=\"d5420dd\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[]}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-13c2ca40 elementor-widget elementor-widget-text-editor\" data-id=\"13c2ca40\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The Cyber Resilience Act (CRA) requires manufacturers to report actively exploited vulnerabilities and severe security incidents in products with digital elements. This reporting obligation takes effect on September 11th 2026, considerably earlier than most other CRA requirements. Who does it apply to, what exactly must be reported, and within what deadlines?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e7d687d elementor-widget-divider--separator-type-pattern elementor-widget-divider--no-spacing elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"e7d687d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\" style=\"--divider-pattern-url: url(&quot;data:image\/svg+xml,%3Csvg xmlns=&#039;http:\/\/www.w3.org\/2000\/svg&#039; preserveAspectRatio=&#039;xMidYMid meet&#039; overflow=&#039;visible&#039; height=&#039;100%&#039; viewBox=&#039;0 0 126 26&#039; fill=&#039;black&#039; stroke=&#039;none&#039;%3E%3Cpath d=&#039;M3,10.2c2.6,0,2.6,2,2.6,3.2S4.4,16.5,3,16.5s-3-1.4-3-3.2S0.4,10.2,3,10.2z M18.8,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.2-1.4-3.2-3.2S17,10.2,18.8,10.2z M34.6,10.2c1.5,0,2.6,1.4,2.6,3.2s-0.5,3.2-1.9,3.2c-1.5,0-3.4-1.4-3.4-3.2S33.1,10.2,34.6,10.2z M50.5,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.3-0.9-3.3-2.6S48.7,10.2,50.5,10.2z M66.2,10.2c1.5,0,3.4,1.4,3.4,3.2s-1.9,3.2-3.4,3.2c-1.5,0-2.6-0.4-2.6-2.1S64.8,10.2,66.2,10.2z M82.2,10.2c1.7,0.8,2.6,1.4,2.6,3.2s-0.1,3.2-1.6,3.2c-1.5,0-3.7-1.4-3.7-3.2S80.5,9.4,82.2,10.2zM98.6,10.2c1.5,0,2.6,0.4,2.6,2.1s-1.2,4.2-2.6,4.2c-1.5,0-3.7-0.4-3.7-2.1S97.1,10.2,98.6,10.2z M113.4,10.2c1.2,0,2.2,0.9,2.2,3.2s-0.1,3.2-1.3,3.2s-3.1-1.4-3.1-3.2S112.2,10.2,113.4,10.2z&#039;\/%3E%3C\/svg%3E&quot;);\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-780fa6d elementor-widget elementor-widget-heading\" data-id=\"780fa6d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Reporting vulnerabilities and incidents under the CRA<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-81daa5b elementor-widget elementor-widget-text-editor\" data-id=\"81daa5b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The CRA affects a wide range of companies: from manufacturers of smart appliances to importers of low-cost electronics and to software firms. In previous articles we explained <a href=\"https:\/\/cybrela.com\/en\/cyber-resilience-act-who-does-it-affect\/\">who the CRA applies to<\/a> and <a href=\"https:\/\/cybrela.com\/en\/products-with-digital-elements-classification-under-cra\/\">what is a product with digital elements<\/a>. Now we turn to one of the obligations that takes effect earlier than most others \u2013 reporting vulnerabilities and incidents.<\/p><p class=\"translation-block\">Much like the czech Cybersecurity Act, the CRA requires certain matters to be reported to the competent authorities. These are primarily <strong>actively exploited vulnerabilities<\/strong> and <strong>severe security incidents<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dbfe79f elementor-blockquote--skin-boxed elementor-blockquote--align-left elementor-widget elementor-widget-blockquote\" data-id=\"dbfe79f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content translation-block\"><b>The obligation to report actively exploited vulnerabilities and severe incidents applies from September 11th 2026<\/b>. The remaining obligations set out in the CRA, such as the product security requirements and conformity assessment, will apply from December 2027.<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55ded10 elementor-alert-warning elementor-widget elementor-widget-alert\" data-id=\"55ded10\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"alert.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-alert\" role=\"alert\">\n\n\t\t\t\n\t\t\t\t\t\t<span class=\"elementor-alert-description\">This article deals with vulnerabilities and incidents relating to products with digital elements for which the entity is responsible as the manufacturer. It does not cover vulnerabilities or incidents in the company's own infrastructure environment. Those types of events are governed by other legislation. <\/span>\n\t\t\t\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a0f07cc elementor-widget-divider--separator-type-pattern elementor-widget-divider--no-spacing elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"a0f07cc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\" style=\"--divider-pattern-url: url(&quot;data:image\/svg+xml,%3Csvg xmlns=&#039;http:\/\/www.w3.org\/2000\/svg&#039; preserveAspectRatio=&#039;xMidYMid meet&#039; overflow=&#039;visible&#039; height=&#039;100%&#039; viewBox=&#039;0 0 126 26&#039; fill=&#039;black&#039; stroke=&#039;none&#039;%3E%3Cpath d=&#039;M3,10.2c2.6,0,2.6,2,2.6,3.2S4.4,16.5,3,16.5s-3-1.4-3-3.2S0.4,10.2,3,10.2z M18.8,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.2-1.4-3.2-3.2S17,10.2,18.8,10.2z M34.6,10.2c1.5,0,2.6,1.4,2.6,3.2s-0.5,3.2-1.9,3.2c-1.5,0-3.4-1.4-3.4-3.2S33.1,10.2,34.6,10.2z M50.5,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.3-0.9-3.3-2.6S48.7,10.2,50.5,10.2z M66.2,10.2c1.5,0,3.4,1.4,3.4,3.2s-1.9,3.2-3.4,3.2c-1.5,0-2.6-0.4-2.6-2.1S64.8,10.2,66.2,10.2z M82.2,10.2c1.7,0.8,2.6,1.4,2.6,3.2s-0.1,3.2-1.6,3.2c-1.5,0-3.7-1.4-3.7-3.2S80.5,9.4,82.2,10.2zM98.6,10.2c1.5,0,2.6,0.4,2.6,2.1s-1.2,4.2-2.6,4.2c-1.5,0-3.7-0.4-3.7-2.1S97.1,10.2,98.6,10.2z M113.4,10.2c1.2,0,2.2,0.9,2.2,3.2s-0.1,3.2-1.3,3.2s-3.1-1.4-3.1-3.2S112.2,10.2,113.4,10.2z&#039;\/%3E%3C\/svg%3E&quot;);\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a34c92b elementor-widget elementor-widget-heading\" data-id=\"a34c92b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">When a vulnerability must be reported<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9b1f65a elementor-widget elementor-widget-text-editor\" data-id=\"9b1f65a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"translation-block\">Not every vulnerability has to be reported under the CRA. <strong>What matters is whether it meets the conditions for notification.<\/strong> The obligation arises the moment a manufacturer, or an entity in the position of a manufacturer, becomes aware that a vulnerability in its product with digital elements <strong>is being actively exploited and that there is reliable evidence of this<\/strong>. In practice, this means that:<\/p><ul><li>there is evidence of actual exploitation of the vulnerability,<\/li><li>the vulnerability is being exploited in a real-world environment, not merely in testing,<\/li><li>it is not just a theoretical or potential threat.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-22686ac elementor-alert-warning elementor-widget elementor-widget-alert\" data-id=\"22686ac\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"alert.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-alert\" role=\"alert\">\n\n\t\t\t\n\t\t\t\t\t\t<span class=\"elementor-alert-description\">Unlike routine vulnerability assessment, <b>what determines whether a report is required is not the severity of the vulnerability<\/b>\u2013 a high CVSS score, for example \u2013 but whether it is actually being exploited.<\/span>\n\t\t\t\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8e54c5d elementor-widget-divider--separator-type-pattern elementor-widget-divider--no-spacing elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"8e54c5d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\" style=\"--divider-pattern-url: url(&quot;data:image\/svg+xml,%3Csvg xmlns=&#039;http:\/\/www.w3.org\/2000\/svg&#039; preserveAspectRatio=&#039;xMidYMid meet&#039; overflow=&#039;visible&#039; height=&#039;100%&#039; viewBox=&#039;0 0 126 26&#039; fill=&#039;black&#039; stroke=&#039;none&#039;%3E%3Cpath d=&#039;M3,10.2c2.6,0,2.6,2,2.6,3.2S4.4,16.5,3,16.5s-3-1.4-3-3.2S0.4,10.2,3,10.2z M18.8,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.2-1.4-3.2-3.2S17,10.2,18.8,10.2z M34.6,10.2c1.5,0,2.6,1.4,2.6,3.2s-0.5,3.2-1.9,3.2c-1.5,0-3.4-1.4-3.4-3.2S33.1,10.2,34.6,10.2z M50.5,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.3-0.9-3.3-2.6S48.7,10.2,50.5,10.2z M66.2,10.2c1.5,0,3.4,1.4,3.4,3.2s-1.9,3.2-3.4,3.2c-1.5,0-2.6-0.4-2.6-2.1S64.8,10.2,66.2,10.2z M82.2,10.2c1.7,0.8,2.6,1.4,2.6,3.2s-0.1,3.2-1.6,3.2c-1.5,0-3.7-1.4-3.7-3.2S80.5,9.4,82.2,10.2zM98.6,10.2c1.5,0,2.6,0.4,2.6,2.1s-1.2,4.2-2.6,4.2c-1.5,0-3.7-0.4-3.7-2.1S97.1,10.2,98.6,10.2z M113.4,10.2c1.2,0,2.2,0.9,2.2,3.2s-0.1,3.2-1.3,3.2s-3.1-1.4-3.1-3.2S112.2,10.2,113.4,10.2z&#039;\/%3E%3C\/svg%3E&quot;);\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8cafd10 elementor-widget elementor-widget-heading\" data-id=\"8cafd10\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">When an incident must be reported<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e1b4d09 elementor-widget elementor-widget-text-editor\" data-id=\"e1b4d09\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"translation-block\">Alongside vulnerabilities, the CRA also addresses severe security incidents. Whereas a vulnerability is a weakness in the product, an incident means there has already been a real <strong>impact on the availability, confidentiality, integrity or authenticity<\/strong> of the data or functions of a product with digital elements.<\/p><p class=\"translation-block\">Typical examples include system compromise or a data breach, an outage affecting the product or its key functions, or ransomware spreading through vulnerabilities in the product. Not every incident is automatically subject to the reporting obligation, however. Under the CRA, <strong>a severity threshold applies<\/strong>. An incident is severe if it:<\/p><ol><li>negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions,<\/li><li>has led or is capable of leading to the introduction or execution of malicious code in the product with digital elements or in the network and information systems of a user of that product.<\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2a7a91a elementor-alert-warning elementor-widget elementor-widget-alert\" data-id=\"2a7a91a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"alert.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-alert\" role=\"alert\">\n\n\t\t\t\n\t\t\t\t\t\t<span class=\"elementor-alert-description\">Assessing the severity of an incident may not be straightforward in practice. Decisions about its impact, scope and relevance often have to be made at a point when you do not yet have all the information available.<\/span>\n\t\t\t\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5f714d6 elementor-widget elementor-widget-text-editor\" data-id=\"5f714d6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>How can you assess severity on a preliminary basis? These basic questions can help:<\/p><ul><li class=\"translation-block\"><b>Product security in general:<\/b> <em>Does the incident affect the security of the product as such?<\/em><\/li><li class=\"translation-block\"><b>Availability<\/b>: <em>Is the product or any of its functions unavailable or degraded?<\/em><\/li><li class=\"translation-block\"><b>Integrity:<\/b> <em>Has data or functionality been altered without authorisation, or could it be?<\/em><\/li><li class=\"translation-block\"><b>Confidentiality:<\/b> <em>Has sensitive data fallen into the hands of someone who should not have access to it?<\/em><\/li><li class=\"translation-block\"><b>Authenticity:<\/b> <em>Can you trust that the system or communication is what it claims to be?<\/em><\/li><li class=\"translation-block\"><b>Compromise:<\/b> <em>Could an attacker have gained control over the product or system?<\/em><\/li><li class=\"translation-block\"><b>Malicious code:<\/b> <em>Was malicious code executed, or could it have been executed, in the product or in the user's system?<\/em><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b498d02 elementor-widget-divider--separator-type-pattern elementor-widget-divider--no-spacing elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"b498d02\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\" style=\"--divider-pattern-url: url(&quot;data:image\/svg+xml,%3Csvg xmlns=&#039;http:\/\/www.w3.org\/2000\/svg&#039; preserveAspectRatio=&#039;xMidYMid meet&#039; overflow=&#039;visible&#039; height=&#039;100%&#039; viewBox=&#039;0 0 126 26&#039; fill=&#039;black&#039; stroke=&#039;none&#039;%3E%3Cpath d=&#039;M3,10.2c2.6,0,2.6,2,2.6,3.2S4.4,16.5,3,16.5s-3-1.4-3-3.2S0.4,10.2,3,10.2z M18.8,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.2-1.4-3.2-3.2S17,10.2,18.8,10.2z M34.6,10.2c1.5,0,2.6,1.4,2.6,3.2s-0.5,3.2-1.9,3.2c-1.5,0-3.4-1.4-3.4-3.2S33.1,10.2,34.6,10.2z M50.5,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.3-0.9-3.3-2.6S48.7,10.2,50.5,10.2z M66.2,10.2c1.5,0,3.4,1.4,3.4,3.2s-1.9,3.2-3.4,3.2c-1.5,0-2.6-0.4-2.6-2.1S64.8,10.2,66.2,10.2z M82.2,10.2c1.7,0.8,2.6,1.4,2.6,3.2s-0.1,3.2-1.6,3.2c-1.5,0-3.7-1.4-3.7-3.2S80.5,9.4,82.2,10.2zM98.6,10.2c1.5,0,2.6,0.4,2.6,2.1s-1.2,4.2-2.6,4.2c-1.5,0-3.7-0.4-3.7-2.1S97.1,10.2,98.6,10.2z M113.4,10.2c1.2,0,2.2,0.9,2.2,3.2s-0.1,3.2-1.3,3.2s-3.1-1.4-3.1-3.2S112.2,10.2,113.4,10.2z&#039;\/%3E%3C\/svg%3E&quot;);\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3d63d05 elementor-widget elementor-widget-heading\" data-id=\"3d63d05\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Reporting deadlines: 24 hours, 72 hours and the final report<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6d2432a elementor-widget elementor-widget-text-editor\" data-id=\"6d2432a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>From September 11th 2026, reporting takes place via the <a href=\"https:\/\/portal.cra-srp.enisa.europa.eu\/\" target=\"_blank\" rel=\"noopener\"><strong>Single Reporting Platform<\/strong><\/a> (SRP) operated by ENISA. Reports are submitted through this platform, and ENISA handles onward distribution to the relevant authorities. Before logging in for the first time, <a href=\"https:\/\/ecas.ec.europa.eu\/cas\/login?loginRequestId=ECAS_LR-23735168-SgVGc5vYHwq1M5yQZGORWF9spT3cGxlQUb9jYvsxKHgzkpWriYBGisjmhkuHo3eTRNJ3jQPVMFVc0DYQzoOECi-POMaLlcnzRyN3VwtazOyDS-YGW5RQzRdpoDRfRB9VjDaZGhn6B9IodXIDJzJsXIohfpXLdRvBT85bFJzNP2ulx84p9WWgJ9F3mcoQznprzW9Kh\" target=\"_blank\" rel=\"noopener\"><strong>set up an EU Login<\/strong><\/a>, which is used to access the platform.<\/p><p class=\"translation-block\">For both vulnerabilities and security incidents, reporting proceeds in several steps. The first deadline is very short \u2013 <b>an early warning must be submitted within 24 hours<\/b>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8ac826 elementor-widget elementor-widget-jet-table\" data-id=\"f8ac826\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"jet-table.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-jet-table jet-elements\">\n\t\t<div class=\"jet-table-wrapper jet-table-responsive-mobile\">\n\t\t\t<table class=\"jet-table jet-table--fa5-compat\">\n\t\t\t\t<thead class=\"jet-table__head\"><tr class=\"jet-table__head-row\"><th class=\"jet-table__cell elementor-repeater-item-f22a4e5 jet-table__head-cell\" scope=\"col\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">Phase<\/div><\/div><\/div><\/th><th class=\"jet-table__cell elementor-repeater-item-2b6688a jet-table__head-cell\" scope=\"col\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">Deadline<\/div><\/div><\/div><\/th><th class=\"jet-table__cell elementor-repeater-item-6db042d jet-table__head-cell\" scope=\"col\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">Vulnerability<\/div><\/div><\/div><\/th><th class=\"jet-table__cell elementor-repeater-item-a9f21a8 jet-table__head-cell\" scope=\"col\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">Incident<\/div><\/div><\/div><\/th><\/tr><\/thead>\n\t\t\t\t\t\t\t\t<tbody class=\"jet-table__body\"><tr class=\"jet-table__body-row elementor-repeater-item-f7523f2\"><td class=\"jet-table__cell elementor-repeater-item-6b9bcdd jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\"><b>Early warning<\/b><\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-63a1d17 jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">Within 24 hours<\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-5462f8e jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">\u2022 Confirmation that an actively exploited vulnerability exists.<br>\n\u2022 Member States where the product is available.\n<\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-0f9db16 jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text translation-block\">\u2022 Confirmation that an incident has occurred.<br>\n\u2022 Whether unlawful or malicious conduct is suspected.<br>\n\u2022 Member States where the product is available.<\/div><\/div><\/div><\/td><\/tr><tr class=\"jet-table__body-row elementor-repeater-item-f015727\"><td class=\"jet-table__cell elementor-repeater-item-2996a5e jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\"><b>Notification<\/b><\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-c920e49 jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">Within 72 hours<\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-d650319 jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">\u2022 The technical nature of the vulnerability and the nature of the exploitation.<br>\n\u2022 Corrective or mitigating measures taken or available.<br>\n\u2022 Measures that users can take.<br>\n\u2022 An assessment of the sensitivity of the information reported.<\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-b4f3358 jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text translation-block\">\u2022 The technical nature of the incident and its initial assessment.<br>\n\u2022 Corrective or mitigating measures taken or available.<br>\n\u2022 Measures that users can take.<br>\n\u2022 An assessment of the sensitivity of the information reported.<\/div><\/div><\/div><\/td><\/tr><tr class=\"jet-table__body-row elementor-repeater-item-1e01d85\"><td class=\"jet-table__cell elementor-repeater-item-a8194dc jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\"><b>Final report<\/b><\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-1a6c2d4 jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text\">Depending on the type of event<\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-61c157e jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text translation-block\">Within 14 days of a corrective or mitigating measure being issued<br>\n\u2022 A description of the vulnerability, including its severity and impact.<br>\n\u2022 Information about the malicious actor (where known).<br>\n\u2022 Details of the security updates or corrective measures.<\/div><\/div><\/div><\/td><td class=\"jet-table__cell elementor-repeater-item-046f4b7 jet-table__body-cell\"><div class=\"jet-table__cell-inner\"><div class=\"jet-table__cell-content\"><div class=\"jet-table__cell-text translation-block\">Within 1 month of the notification submitted within 72 hours<br>\n\u2022 A detailed description of the incident, including its severity and impact.<br>\n\u2022 The type of threat or root cause of the incident.<br>\n\u2022 Ongoing mitigating measures.<\/div><\/div><\/div><\/td><\/tr><\/tbody>\n\t\t\t<\/table>\n\t\t<\/div>\n\n\t\t<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-88ad597 elementor-widget-divider--separator-type-pattern elementor-widget-divider--no-spacing elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"88ad597\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\" style=\"--divider-pattern-url: url(&quot;data:image\/svg+xml,%3Csvg xmlns=&#039;http:\/\/www.w3.org\/2000\/svg&#039; preserveAspectRatio=&#039;xMidYMid meet&#039; overflow=&#039;visible&#039; height=&#039;100%&#039; viewBox=&#039;0 0 126 26&#039; fill=&#039;black&#039; stroke=&#039;none&#039;%3E%3Cpath d=&#039;M3,10.2c2.6,0,2.6,2,2.6,3.2S4.4,16.5,3,16.5s-3-1.4-3-3.2S0.4,10.2,3,10.2z M18.8,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.2-1.4-3.2-3.2S17,10.2,18.8,10.2z M34.6,10.2c1.5,0,2.6,1.4,2.6,3.2s-0.5,3.2-1.9,3.2c-1.5,0-3.4-1.4-3.4-3.2S33.1,10.2,34.6,10.2z M50.5,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.3-0.9-3.3-2.6S48.7,10.2,50.5,10.2z M66.2,10.2c1.5,0,3.4,1.4,3.4,3.2s-1.9,3.2-3.4,3.2c-1.5,0-2.6-0.4-2.6-2.1S64.8,10.2,66.2,10.2z M82.2,10.2c1.7,0.8,2.6,1.4,2.6,3.2s-0.1,3.2-1.6,3.2c-1.5,0-3.7-1.4-3.7-3.2S80.5,9.4,82.2,10.2zM98.6,10.2c1.5,0,2.6,0.4,2.6,2.1s-1.2,4.2-2.6,4.2c-1.5,0-3.7-0.4-3.7-2.1S97.1,10.2,98.6,10.2z M113.4,10.2c1.2,0,2.2,0.9,2.2,3.2s-0.1,3.2-1.3,3.2s-3.1-1.4-3.1-3.2S112.2,10.2,113.4,10.2z&#039;\/%3E%3C\/svg%3E&quot;);\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5a7923e elementor-widget elementor-widget-heading\" data-id=\"5a7923e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Informing users: the obligation does not end with the regulator<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8dd94cd elementor-widget elementor-widget-text-editor\" data-id=\"8dd94cd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"translation-block\">Reporting to the regulator is not the only communication obligation. The CRA also requires manufacturers to <b>inform affected users of the product without undue delay<\/b>. Where affected users cannot be reliably identified, it may be necessary to inform all users. Users should be told:<\/p><ul><li>which vulnerability or incident affects them,<\/li><li>what corrective measures the manufacturer has taken or is preparing,<\/li><li>what they can do themselves to limit the impact.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b0b097d elementor-alert-warning elementor-widget elementor-widget-alert\" data-id=\"b0b097d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"alert.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-alert translation-block\" role=\"alert\"><span class=\"elementor-alert-description\">This obligation applies even where a corrective or mitigating measure is not yet available. Waiting to communicate until a fix has been released is therefore not enough. Users <b>must at least receive recommendations<\/b> on how they can limit the risk in the meantime.<\/span><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-faae089 elementor-widget-divider--separator-type-pattern elementor-widget-divider--no-spacing elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"faae089\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\" style=\"--divider-pattern-url: url(&quot;data:image\/svg+xml,%3Csvg xmlns=&#039;http:\/\/www.w3.org\/2000\/svg&#039; preserveAspectRatio=&#039;xMidYMid meet&#039; overflow=&#039;visible&#039; height=&#039;100%&#039; viewBox=&#039;0 0 126 26&#039; fill=&#039;black&#039; stroke=&#039;none&#039;%3E%3Cpath d=&#039;M3,10.2c2.6,0,2.6,2,2.6,3.2S4.4,16.5,3,16.5s-3-1.4-3-3.2S0.4,10.2,3,10.2z M18.8,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.2-1.4-3.2-3.2S17,10.2,18.8,10.2z M34.6,10.2c1.5,0,2.6,1.4,2.6,3.2s-0.5,3.2-1.9,3.2c-1.5,0-3.4-1.4-3.4-3.2S33.1,10.2,34.6,10.2z M50.5,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.3-0.9-3.3-2.6S48.7,10.2,50.5,10.2z M66.2,10.2c1.5,0,3.4,1.4,3.4,3.2s-1.9,3.2-3.4,3.2c-1.5,0-2.6-0.4-2.6-2.1S64.8,10.2,66.2,10.2z M82.2,10.2c1.7,0.8,2.6,1.4,2.6,3.2s-0.1,3.2-1.6,3.2c-1.5,0-3.7-1.4-3.7-3.2S80.5,9.4,82.2,10.2zM98.6,10.2c1.5,0,2.6,0.4,2.6,2.1s-1.2,4.2-2.6,4.2c-1.5,0-3.7-0.4-3.7-2.1S97.1,10.2,98.6,10.2z M113.4,10.2c1.2,0,2.2,0.9,2.2,3.2s-0.1,3.2-1.3,3.2s-3.1-1.4-3.1-3.2S112.2,10.2,113.4,10.2z&#039;\/%3E%3C\/svg%3E&quot;);\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b330382 elementor-widget elementor-widget-heading\" data-id=\"b330382\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What to have ready before your first report<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-969081a elementor-widget elementor-widget-text-editor\" data-id=\"969081a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"translation-block\">The biggest problem with a first report <b>may not be technical but procedural<\/b>. Companies should be clear in advance above all about who decides that an event meets the conditions for reporting, who actually submits the report, who approves communication to users, and where information about the event will be stored as it comes in, so that the team does not have to track it down after the fact.<\/p><p>The minimum worth having ready:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-226800d elementor-view-stacked elementor-position-inline-start elementor-shape-circle elementor-mobile-position-block-start elementor-widget elementor-widget-icon-box\" data-id=\"226800d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-icon-box-wrapper\">\n\n\t\t\t\t\t\t<div class=\"elementor-icon-box-icon\">\n\t\t\t\t<span  class=\"elementor-icon\">\n\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-right\"><\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t<div class=\"elementor-icon-box-content\">\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<p class=\"elementor-icon-box-description translation-block\"><b>Access to the single reporting platform<\/b> \u2013 sort out registration in advance and test your access. When the 24-hour clock is running, you do not want to be dealing with logins or permissions.<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8669075 elementor-view-stacked elementor-position-inline-start elementor-shape-circle elementor-mobile-position-block-start elementor-widget elementor-widget-icon-box\" data-id=\"8669075\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-icon-box-wrapper\">\n\n\t\t\t\t\t\t<div class=\"elementor-icon-box-icon\">\n\t\t\t\t<span  class=\"elementor-icon\">\n\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-right\"><\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t<div class=\"elementor-icon-box-content\">\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<p class=\"elementor-icon-box-description translation-block\"><b>An internal reporting procedure<\/b> \u2013 determine who assesses the incident or vulnerability, who decides whether the conditions for reporting are met, and who actually submits the report.<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9232c18 elementor-view-stacked elementor-position-inline-start elementor-shape-circle elementor-mobile-position-block-start elementor-widget elementor-widget-icon-box\" data-id=\"9232c18\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-icon-box-wrapper\">\n\n\t\t\t\t\t\t<div class=\"elementor-icon-box-icon\">\n\t\t\t\t<span  class=\"elementor-icon\">\n\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-right\"><\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t<div class=\"elementor-icon-box-content\">\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<p class=\"elementor-icon-box-description translation-block\"><b>An escalation and communication procedure<\/b> \u2013 determine who approves communication to users and who then carries it out.<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3d09e75 elementor-alert-warning elementor-widget elementor-widget-alert\" data-id=\"3d09e75\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"alert.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-alert translation-block\" role=\"alert\"><span class=\"elementor-alert-description\">It is worth running through the whole procedure <b>at least once as a dry run<\/b>. With a 24-hour deadline, it quickly becomes clear where information, responsibility or decision-making authority is missing.<\/span><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2a4a6c8 elementor-widget-divider--separator-type-pattern elementor-widget-divider--no-spacing elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"2a4a6c8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\" style=\"--divider-pattern-url: url(&quot;data:image\/svg+xml,%3Csvg xmlns=&#039;http:\/\/www.w3.org\/2000\/svg&#039; preserveAspectRatio=&#039;xMidYMid meet&#039; overflow=&#039;visible&#039; height=&#039;100%&#039; viewBox=&#039;0 0 126 26&#039; fill=&#039;black&#039; stroke=&#039;none&#039;%3E%3Cpath d=&#039;M3,10.2c2.6,0,2.6,2,2.6,3.2S4.4,16.5,3,16.5s-3-1.4-3-3.2S0.4,10.2,3,10.2z M18.8,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.2-1.4-3.2-3.2S17,10.2,18.8,10.2z M34.6,10.2c1.5,0,2.6,1.4,2.6,3.2s-0.5,3.2-1.9,3.2c-1.5,0-3.4-1.4-3.4-3.2S33.1,10.2,34.6,10.2z M50.5,10.2c1.7,0,3.2,1.4,3.2,3.2s-1.4,3.2-3.2,3.2c-1.7,0-3.3-0.9-3.3-2.6S48.7,10.2,50.5,10.2z M66.2,10.2c1.5,0,3.4,1.4,3.4,3.2s-1.9,3.2-3.4,3.2c-1.5,0-2.6-0.4-2.6-2.1S64.8,10.2,66.2,10.2z M82.2,10.2c1.7,0.8,2.6,1.4,2.6,3.2s-0.1,3.2-1.6,3.2c-1.5,0-3.7-1.4-3.7-3.2S80.5,9.4,82.2,10.2zM98.6,10.2c1.5,0,2.6,0.4,2.6,2.1s-1.2,4.2-2.6,4.2c-1.5,0-3.7-0.4-3.7-2.1S97.1,10.2,98.6,10.2z M113.4,10.2c1.2,0,2.2,0.9,2.2,3.2s-0.1,3.2-1.3,3.2s-3.1-1.4-3.1-3.2S112.2,10.2,113.4,10.2z&#039;\/%3E%3C\/svg%3E&quot;);\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9c4644d e-flex e-con-boxed e-con e-parent\" data-id=\"9c4644d\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[]}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c3ca925 elementor-cta--skin-cover elementor-bg-transform elementor-bg-transform-zoom-in elementor-widget elementor-widget-call-to-action\" data-id=\"c3ca925\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"call-to-action.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-cta\">\n\t\t\t\t\t<div class=\"elementor-cta__bg-wrapper\">\n\t\t\t\t<div class=\"elementor-cta__bg elementor-bg\" style=\"background-image: url();\" role=\"img\" aria-label=\"\"><\/div>\n\t\t\t\t<div class=\"elementor-cta__bg-overlay\"><\/div>\n\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-cta__content\">\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<h2 class=\"elementor-cta__title elementor-cta__content-item elementor-content-item\">\n\t\t\t\t\t\tDoes the CRA apply to you?\t\t\t\t\t<\/h2>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-cta__description elementor-cta__content-item elementor-content-item\">\n\t\t\t\t\t\tWe will help you with the initial classification of your product portfolio, the identification of your obligations and the design of a plan for meeting the CRA requirements, so that you can continue placing your products on the EU market.\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-cta__button-wrapper elementor-cta__content-item elementor-content-item\">\n\t\t\t\t\t<a class=\"elementor-cta__button elementor-button elementor-size-\" href=\"\/en\/contact\/\">\n\t\t\t\t\t\tContact us\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>From September 11th 2026, the CRA requires manufacturers to report actively exploited vulnerabilities and severe incidents. An overview of the conditions, the deadlines, and what to have ready.<\/p>","protected":false},"author":8,"featured_media":14024,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[107],"tags":[105],"class_list":["post-13987","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cra","tag-cyber-resilience-act"],"_links":{"self":[{"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/posts\/13987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/comments?post=13987"}],"version-history":[{"count":3,"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/posts\/13987\/revisions"}],"predecessor-version":[{"id":14284,"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/posts\/13987\/revisions\/14284"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/media\/14024"}],"wp:attachment":[{"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/media?parent=13987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/categories?post=13987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybrela.com\/en\/wp-json\/wp\/v2\/tags?post=13987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}