Cyber Resilience Act: reporting obligations apply from 11 September. How to prepare with ISO/IEC 27001

Since 11 September 2026, the reporting obligations laid down in the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) have been in force. They apply to manufacturers of products with digital elements that fall within the scope of the regulation, including products already on the market. The remaining CRA obligations will apply from 11 December 2027.

What must be reported and when

Manufacturers must report two types of events: actively exploited vulnerabilities and severe incidents affecting the security of the product. Deadlines run from the moment the manufacturer becomes aware of them:

early warning within 24 hours;
notification within 72 hours;
final report within 14 days of a corrective measure becoming available, for exploited vulnerabilities, or within one month of the notification, for severe incidents.

Reports must be submitted simultaneously to ENISA and to the relevant national CSIRT through the single reporting platform. The manufacturer must also inform the users affected.

An increasingly dense regulatory landscape

The CRA is not the only front. The NIS2 Directive and the Data Act, which applies to connected products from 12 September 2026, extend obligations for businesses and suppliers. Nor is the picture consistent across EU countries: Spain, for example, has not yet completed its transposition of NIS2, and in July 2026 the European Commission referred it to the Court of Justice.

The value of a certified management system

Responding to an incident within 24 hours requires defined roles, tested processes and risk management that is already in place. These are the requirements on which ISO/IEC 27001 is built, the international standard for information security management systems: risk assessment, incident management, leadership responsibility, continual improvement.

ISO/IEC 27001 certification does not equal CRA compliance, nor does it replace legal obligations. It does, however, provide an internationally recognised framework on which to build the required procedures, which is also useful for organisations operating in several countries with different regulations.

How A Cube TIC can help

A Cube TIC, a global Testing, Inspection & Certification group operating in around 25 countries, certifies management systems to ISO/IEC 27001. October is European Cybersecurity Month: a good time to review your system and work out how to structure it.

Sources: Regulation (EU) 2024/2847; Jones Day; ACBSEC.