CRA 24-hour vulnerability reporting for makers of SaaS products with apps
Short answer: If your SaaS product with an app is in scope and you become aware of an actively exploited vulnerability or a severe incident, you report via ENISA’s Single Reporting Platform (live since 11 Sep 2026): an early warning within 24 hours, a fuller notification within 72 hours, and a final report later (14 days after a fix is available for vulnerabilities; one month for severe incidents). Check exact timelines in Art. 14.
Example for a SaaS product with an app: Your on-prem agent has a privilege-escalation bug being exploited at customers.
Prepare now
- Name who decides “actively exploited” and who submits (24h clock runs from awareness, weekends included).
- Keep a pre-filled early-warning template: product, version, exploited?, member states affected.
- Line up how you’ll inform affected users once a fix or mitigation exists.
- Log decisions; you’ll need them for the 72h and final reports.
FAQ
- Does this apply before Dec 2027? Yes, reporting started 11 Sep 2026, including for products already on the market.
- Do I need a runbook? Not mandated by name, but a 24h/72h/14-day runbook is the practical way to hit the clock.
Related: Is my SaaS product with an app in scope?
Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.
Last reviewed: 2026-10-30