Since 11 September 2026, every company that sells software or connected hardware in the EU has a 24-hour clock it did not have before. Most small manufacturers I talk to still do not know it is running.
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, entered into force on 10 December 2024 and applies in phases. The first phase that bites every manufacturer went live on 11 September 2026: the duty to report actively exploited vulnerabilities and severe incidents affecting your products. It applies to all products with digital elements made available in the EU, including products that were already on the market before the date. The rest of the CRA, from security by design to CE marking, follows on 11 December 2027.
This matters well beyond big tech. If you sell CAD software, a CAD plugin, firmware, an IoT sensor, a 3D printer, a connected machine or a desktop tool with an online component, you are probably a "manufacturer" under the CRA. CADChain is one too: our BORIS plugins are products with digital elements. So this guide is written from the inside: what the reporting rules say, how they interact with NIS2 and GDPR, and what a small team has to set up to meet a 24-hour deadline.
TL;DR: Cyber Resilience Act reporting in one paragraph
From 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report 14 days after a fix is available (vulnerabilities) or one month after the notification (incidents). Reports go to the CSIRT of the member state where you have your main establishment. You must also inform affected users. The obligation covers old and new products. Fines for breaching the CRA's core obligations can reach €15 million or 2.5% of worldwide annual turnover. The full product requirements apply from 11 December 2027, so use the next 14 months to build the process properly.
What changed on 11 September 2026
The Commission's announcement was blunt: manufacturers must now report any actively exploited vulnerabilities and severe incidents that affect product security, through the CRA Single Reporting Platform run by ENISA, and national market surveillance authorities enforce the rules. The Commission published practical guidance on these obligations in July 2026, and the Commission's CRA reporting page is the official starting point.
Are you a manufacturer of a product with digital elements?
A product with digital elements is, roughly, any software or hardware product whose intended use includes a data connection to a device or network, including the remote data processing it needs to work. A manufacturer is whoever develops or has it developed and markets it under its own name, wherever that company is based. A US or UK company selling into the EU is in scope for its EU sales.
What you must report, and when
Two kinds of events trigger the duty. An actively exploited vulnerability is a flaw in your product for which there is reliable evidence that someone has exploited it without permission. A severe incident is one that harms your product's ability to protect important data or functions, or that leads to malicious code being introduced or executed, for example through your update channel.
The reports go through ENISA's Single Reporting Platform to the CSIRT designated as coordinator in the member state of your main establishment, usually where most cybersecurity decisions are taken. That CSIRT shares them with other affected member states. Notifications are not normally public, but a CSIRT can inform users itself if you do not do it in time.
How CRA reporting fits with NIS2 and GDPR
One incident can now trigger three or four reports with different clocks and different recipients. We walked through the Dutch version of this in our Albert Heijn hack deep dive. Here is how the CRA sits next to the others:
A software company that is also an important entity under NIS2, and whose product flaw exposed customer personal data, could owe a CRA report, a NIS2 report and a GDPR report about the same event. Build one internal incident process with one clock, and map each report onto it. For the personal data side in engineering contexts, see our GDPR compliance guide for CAD and DRM.
Penalties and who is spared
Breaching the CRA's essential requirements or the manufacturer obligations, including reporting, can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Other breaches carry lower ceilings. Market surveillance authorities can also order corrective action, withdrawal or recall of products. The regulation includes some relief for small companies: micro and small enterprises cannot be fined for missing the 24-hour early warning deadline, and open-source software stewards are not fined under the CRA. The 72-hour notification and everything else still apply.
What CAD software and engineering tool makers should do now
Engineering software has a specific risk profile. CAD tools parse complex file formats from untrusted sources, run scripts and plugins, and sit on workstations full of valuable IP. In 2026 alone, Autodesk published advisories for crafted DXF and image files that could lead to code execution, which we explain in how a CAD file becomes an attack. If one of those flaws were actively exploited, the vendor would now have a CRA reporting duty. The same applies to every plugin vendor in the chain.
- Inventory your products. List every product with digital elements you sell in the EU, including old versions still in use and the backends they rely on. Decide which legal entity is the manufacturer for each.
- Pick your main establishment and CSIRT. Know in advance which member state's CSIRT receives your reports, and register on ENISA's Single Reporting Platform.
- Define "becoming aware". Write down who decides that a vulnerability is actively exploited or an incident is severe. The 24 hours start then, including weekends.
- Open a front door for researchers. Publish a vulnerability disclosure policy and a security contact. Most exploited-vulnerability reports start as an email from outside.
- Know your components. Keep a software bill of materials, so that a flaw in a file-parsing library or a third-party plugin can be traced to your products within hours. See third-party software vulnerabilities in CAD workflows.
- Prepare user communication. Have templates for security advisories and a channel to reach every customer, including those on old versions.
- Rehearse. Run a tabletop exercise: an exploited flaw in your file importer is found on a Friday evening. Can you file the early warning by Saturday evening?
- Use the time until December 2027. Start on security by design, vulnerability handling, support periods and secure updates now, while the stakes are lower.
If you buy CAD software and connected equipment
The CRA also changes what you can expect from your suppliers. From December 2027, products must ship without known exploitable vulnerabilities, with security updates for a defined support period and secure default settings. Start asking vendors today about their CRA readiness, their vulnerability disclosure policy and their support periods, and make it part of procurement. It is the same logic we describe in CAD file security in the supply chain.
Security by design for your design files. CADChain's BORIS plugins for SolidWorks, Autodesk Inventor and Blender encrypt and certify CAD files inside the tools your engineers already use, control access per user and per file, and keep a verifiable record of every version. If a workstation or a partner is compromised, your files stay locked.
👉 Protect your CAD files with CADChain
Mistakes manufacturers are already making
- "We are too small for this." There is no size threshold for being a manufacturer. Small companies get some relief on fines, not an exemption.
- "It starts in 2027." The main obligations do. Reporting has applied since 11 September 2026.
- "Only new products." Reporting covers products already on the market, including older versions.
- No owner for the clock. If nobody is on call to decide whether something is reportable, 24 hours pass before anyone notices.
- Separate processes for CRA, NIS2 and GDPR. Three teams with three clocks guarantee one missed deadline.
What happens next
Expect the first enforcement cases, more Commission guidance and harmonised standards ahead of December 2027. Expect customers, especially larger manufacturers subject to NIS2, to push CRA requirements down to their software and component suppliers through contracts. For the broader picture of why this regulation exists, read our analysis of the European Commission hacks, and for a live example of what happens when a supply chain is hit, the Vercel breach deep dive. And if you share design data with partners, our breakdown of the Joby trade secret verdict shows why evidence of who accessed what matters as much as the security itself.
This article reflects the Cyber Resilience Act and Commission guidance as of 13 October 2026. It is general information, not legal advice.
FAQ: Cyber Resilience Act reporting
When did Cyber Resilience Act reporting start?
On 11 September 2026. From that date, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products with digital elements. Most other CRA obligations apply from 11 December 2027.
What are the CRA reporting deadlines?
An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report no later than 14 days after a corrective measure is available for an exploited vulnerability, or one month after the notification for a severe incident.
Where do I submit a CRA report?
Through ENISA's Single Reporting Platform, addressed to the CSIRT designated as coordinator in the member state of your main establishment in the EU. That CSIRT shares the report with other affected member states.
Does the CRA apply to products already on the market?
Yes. The reporting obligations apply to all products with digital elements made available in the EU, including those placed on the market before 11 September 2026.
Does the Cyber Resilience Act apply to CAD software and plugins?
In most cases yes, if they are supplied commercially in the EU. Desktop software, plugins and firmware are products with digital elements, and the cloud services they need to function are covered as part of the product.
What are the fines under the Cyber Resilience Act?
Up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential requirements or core manufacturer obligations, including reporting. Micro and small enterprises cannot be fined for missing the 24-hour early warning deadline.
Is SaaS covered by the Cyber Resilience Act?
Pure software-as-a-service without a product attached is generally outside the CRA and falls under NIS2 instead. Remote data processing that a product needs to function is covered as part of that product.
Do I still need to report under GDPR and NIS2?
Yes, if those regimes apply. A single incident can trigger CRA, NIS2 and GDPR reports with different recipients and deadlines, so build one incident process that serves all of them.
