CRA Vulnerability Reporting: The 24-Hour Rule and What It Means

One of the CRA's most operationally demanding requirements is the obligation to report actively exploited vulnerabilities to ENISA within 24 hours of awareness. This isn't a future concern — it takes effect in September 2026.

What Must Be Reported

• Actively exploited vulnerabilities in your product
• Severe incidents impacting the security of your product
• Early warning within 24 hours, followed by detailed notification within 72 hours, and a final report within 14 days

Who You Report To

Reports go to ENISA (European Union Agency for Cybersecurity) via a single reporting platform. ENISA then coordinates with national CSIRTs (Computer Security Incident Response Teams) in affected member states.

Operational Requirements

To meet the 24-hour window, you need:

• Continuous monitoring — Vulnerability feeds, threat intelligence, security scanning
• Triage processes — Rapid assessment of whether a vulnerability is actively exploited
• Reporting workflows — Pre-defined templates and escalation paths
• On-call teams — 24/7 capability to assess and report
• Documentation — Audit trail of discovery, assessment, and reporting actions

The Coordination Challenge

If your product uses open-source components (and it almost certainly does), vulnerability discovery often happens externally. You need processes to monitor upstream disclosures, assess applicability to your product, and coordinate patched releases — all while meeting the reporting timeline.