CRA 24-hour vulnerability reporting for IoT device makers

Short answer: If your IoT device is in scope and you become aware of an actively exploited vulnerability or a severe incident, you report via ENISA’s Single Reporting Platform (live since 11 Sep 2026): an early warning within 24 hours, a fuller notification within 72 hours, and a final report later (14 days after a fix is available for vulnerabilities; one month for severe incidents). Check exact timelines in Art. 14.

Example for an IoT device: A botnet is actively exploiting default credentials on a device model you sell.

Prepare now

• Name who decides “actively exploited” and who submits (24h clock runs from awareness, weekends included).
• Keep a pre-filled early-warning template: product, version, exploited?, member states affected.
• Line up how you’ll inform affected users once a fix or mitigation exists.
• Log decisions; you’ll need them for the 72h and final reports.

FAQ

• Does this apply before Dec 2027? Yes, reporting started 11 Sep 2026, including for products already on the market.
• Do I need a runbook? Not mandated by name, but a 24h/72h/14-day runbook is the practical way to hit the clock.

Related: Is my IoT device in scope? · CVD policy

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30