The CRA clock starts at 24 hours: what to ask a software vendor now

What changed on 11 September 2026

The reporting duty in the EU Cyber Resilience Act went live on 11 September 2026, and it is the first part of the regulation to bite. The product requirements and the CE marking that most vendors talk about arrive on 11 December 2027; the notification obligation is already enforceable. Denmark's national cyber authority put the scope plainly: businesses that produce products with digital elements must report digital vulnerabilities and serious IT security incidents, and that covers software as well as hardware.

Two things make this a procurement problem rather than a legal curiosity. The duty attaches to the manufacturer, not to the customer, so an enterprise that buys software inherits nothing directly and everything indirectly. And the products in scope are not only new ones. The same national notice states that older products are covered and that anything available on the European market today counts, which pulls the installed base of a ten-year-old ERP add-on into the same reporting regime as a release shipped last quarter.

The filing route is narrower than the obligations most security teams already run. One notification goes through ENISA's Single Reporting Platform to the CSIRT designated as coordinator for the manufacturer's member state, and is made available to ENISA at the same time; that authority then shares it with the other national CSIRTs where the product is sold. There is no parallel filing in each country, which is the one piece of good news for a vendor selling across the single market, and it means a single missed deadline is also a single, traceable failure.

The clock starts when the vendor knows

The deadlines are short enough that they change what a vendor has to have built before an incident, not during one. A manufacturer files an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a serious incident, a more detailed notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, or within one month of the 72-hour notification for a serious incident. All the clocks start at the moment the manufacturer gains knowledge.

The 24-hour filing is deliberately not a full investigation. The regulation allows information to be supplied progressively, so the vendor is expected to make an early call while forensics are still running. That is the part procurement tends to miss: a supplier that cannot classify and escalate an event inside a working day has no realistic route to compliance, whatever its security questionnaire says about incident response.

The sequence a buyer can audit

Because every notification goes through one platform to one coordinating authority, a vendor's readiness can be checked against a short, concrete sequence. The question to ask is not whether the supplier has a process, but who performs each step and what the customer receives as evidence that it happened.

Where the vendor's answer usually breaks

ENISA's platform is operated by people, and the people are the failure point. Each manufacturer appoints a primary Assigned Representative plus backups, and the platform allows one primary and up to twenty secondaries. They sign in through individual EU Login accounts with multi-factor authentication, which means the reporting route depends on named individuals having working credentials and out-of-hours cover rather than on a shared mailbox.

The other structural trap is the choice of authority. A manufacturer reports to the CSIRT of the member state where its main establishment sits, meaning where product cybersecurity decisions are predominantly taken, and a wrong selection risks invalidation and resubmission. ENISA does not currently recommend that manufacturers register on the platform before a reportable event, so the registration step is likely to be executed for the first time under a 24-hour clock.

The supply-chain gap belongs in the contract

Most enterprises are also suppliers. If a company embeds a third-party component in a product it places on the EU market, it inherits the reporting duty for that product and depends on its own vendors telling it quickly enough to file within 24 hours. The published advice is explicit that customers and upstream suppliers should be contractually required to notify of vulnerabilities and incidents they have identified. Without that clause the manufacturer's clock starts late, through no fault of its own.

For a buyer that is not a manufacturer, the same clause works in the other direction. A software supplier that must report to a regulator has an incentive to notify its customers at the same time, because the customer's own downstream obligations and the reputational cost of a silent exploited vulnerability both land on the relationship. The clause is cheap to add and it is the only part of this regime a procurement team controls.

What to write before the next renewal

The decision rule is narrow. If the supplier sells a product with digital elements into the EU and cannot name its Assigned Representative, the coordinating CSIRT it reports to, and a tested out-of-hours escalation path, treat the compliance claim as unverified and price the risk into the renewal. If it can name all three, ask for the notification template and the internal log that records the awareness timestamp, because those are what turn a policy into a filing.

Then add the reporting deadline to the service level rather than the security schedule: a supplier that commits to telling you within 24 hours of its own awareness is offering a promise it can keep, and one that commits to telling you after the regulator publishes is not. That single number is the sentence to repeat in the renewal call.