Manufacturers selling connected devices and software in the European Union must now report actively exploited vulnerabilities and severe security incidents through a new central portal, following the launch of the Cyber Resilience Act’s Single Reporting Platform.
The platform, operated by the EU Agency for Cybersecurity, known as ENISA, entered its initial operating phase on 11 September. It is intended to give manufacturers one route for notifications affecting products with digital elements made available on the EU market, rather than requiring separate initial reports to multiple national bodies.
The change is the first major compliance deadline to take effect under the Cyber Resilience Act, a regulation intended to strengthen cybersecurity requirements for connected hardware and software across their lifecycle. The Act entered into force in December 2024, but most of its wider product-security duties are not due to apply until 11 December 2027.
A new reporting route
From 11 September, manufacturers must notify authorities when they become aware of a vulnerability that is being actively exploited or a severe incident affecting the security of a product with digital elements. The obligation is not a general requirement to report every flaw found in a product; it is focused on the categories set out in the legislation.
Under the Commission’s published guidance, an early warning is due without undue delay and no later than 24 hours after the manufacturer becomes aware of the event. A fuller notification is due within 72 hours. The subsequent final-report timetable differs according to whether the matter is an actively exploited vulnerability or a severe incident.
The new portal is designed to channel a notification initially to the Computer Security Incident Response Team, or CSIRT, in the country where a manufacturer has its main establishment. Information is also made available to ENISA, except where particular exceptional circumstances apply. The receiving CSIRT can then share the notification with counterparts in other member states where the affected product has been made available.
ENISA said the single route should help relevant authorities receive information more efficiently and support action to reduce cybersecurity risks. The agency has made supporting material available for users, including guidance on registration, submission and notification workflows, and said the platform’s functions would continue to develop in light of operational experience and user needs.
First step before wider rules apply
The Cyber Resilience Act covers products with digital elements, a broad category that includes much of the connected hardware and software placed on the EU market. Its wider framework requires manufacturers to consider cybersecurity in the planning, design, development and maintenance of products. Some products considered particularly important for cybersecurity may require a third-party assessment before they can be sold.
Those broader obligations, along with the main requirements relating to the security of products, are scheduled to apply from December 2027. The Commission has presented the earlier reporting deadline as a way of improving the flow of information about significant cyber risks before the full framework comes into operation.
The timing is also important for open-source software stewards. Although the platform has been built to support them, the reporting obligations for those stewards are due to apply from 11 December 2027, and only to the extent set out in the Act for stewards involved in the development of products with digital elements. Their inclusion in the portal should therefore not be read as an immediate reporting obligation for every open-source project.
For manufacturers, however, the reporting requirement is now in force. The launch puts the new system into practical use while EU institutions, national CSIRTs and companies prepare for the much broader set of Cyber Resilience Act duties that will follow next year.
