CRA 24-hour vulnerability reporting for firmware makers
Short answer: If your firmware is in scope and you become aware of an actively exploited vulnerability or a severe incident, you report via ENISA’s Single Reporting Platform (live since 11 Sep 2026): an early warning within 24 hours, a fuller notification within 72 hours, and a final report later (14 days after a fix is available for vulnerabilities; one month for severe incidents). Check exact timelines in Art. 14.
Example for a firmware: An exploited flaw in your bootloader affects several customers’ devices.
Prepare now
- Name who decides “actively exploited” and who submits (24h clock runs from awareness, weekends included).
- Keep a pre-filled early-warning template: product, version, exploited?, member states affected.
- Line up how you’ll inform affected users once a fix or mitigation exists.
- Log decisions; you’ll need them for the 72h and final reports.
FAQ
- Does this apply before Dec 2027? Yes, reporting started 11 Sep 2026, including for products already on the market.
- Do I need a runbook? Not mandated by name, but a 24h/72h/14-day runbook is the practical way to hit the clock.
Related: Is my firmware in scope? · CVD policy
Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.
Last reviewed: 2026-10-30