The Cyber Resilience Act (Regulation (EU) 2024/2847) reached its first major milestone on 11 September 2026. From that date, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents affecting their products. Most remaining obligations, including security-by-design requirements and conformity assessment, apply from 11 December 2027.
Industrial products are firmly in scope: controllers, HMIs, gateways, industrial switches, engineering software and many smart field devices are "products with digital elements".
What manufacturers must now do
For an actively exploited vulnerability or a severe incident, the CRA sets a staged timeline through the single reporting platform operated with ENISA:
- an early warning within 24 hours of becoming aware,
- a notification within 72 hours with more detail,
- a final report after a fix or mitigation is available (for vulnerabilities) or within one month (for incidents).
Manufacturers must also inform affected users about the issue and the mitigations they can apply.
What this means for asset owners
Even if you never place products on the market, the CRA changes your inputs:
- More, and faster, advisories. Expect vendors to publish information sooner. Your team needs a way to tell which advisories apply to which installed devices. That depends on an asset inventory with firmware versions.
- Better supplier conversations. You can now ask suppliers how they meet CRA vulnerability handling duties and how they will notify you.
- Long-lived legacy remains your problem. The CRA does not retrofit security into equipment already installed. Compensating controls stay essential.
What this means for integrators and OEMs
Machine builders and integrators who place products on the market may be manufacturers under the CRA. Combined with the Machinery Regulation (EU) 2023/1230, which applies from January 2027 and adds protection against corruption, product security now needs an owner and a process.
A short action list
- Map which of your products or installed assets fall under the CRA.
- Assign an owner for advisory intake and a playbook for 24-hour decisions.
- Link advisories to affected assets and document patch, mitigate or accept decisions.
- Update supplier contracts to cover vulnerability notification.
How OTVista helps
Vulnerability & Advisory Management links advisories to the assets in Asset Visibility and records every decision. Our OT vulnerability management service helps set up the process.
General information, not legal advice. Check the official text of Regulation (EU) 2024/2847.
Topics: Cyber Resilience Act, CRA reporting obligations, actively exploited vulnerability, ENISA single reporting platform, OT product security, PLC vulnerability