You sell into the EU. Since September 11, 2026, an exploited vulnerability in your product has to be reported within 24 hours.
The Cyber Resilience Act (Regulation (EU) 2024/2847) covers software and connected products made available on the EU market, wherever the manufacturer is based. Reporting duties started on September 11, 2026. The rest, including SBOMs, security updates and CE marking, applies from December 11, 2027. Reprisa sets up the process, the tooling and the paperwork so a team in the US, the UK or Asia can meet those deadlines from outside the EU.
Three dates that matter
All from Article 71 of the regulation. The first one is already behind us.
June 11, 2026
Conformity assessment bodies
The rules on notifying conformity assessment bodies (Chapter IV) started to apply, so notified bodies can be designated ahead of 2027.
September 11, 2026
Reporting is live
Article 14 applies. Actively exploited vulnerabilities and severe incidents go through ENISA's single reporting platform. This also covers products you placed on the market years ago (Article 69(3)).
December 11, 2027
Everything else
Essential requirements of Annex I, SBOM, vulnerability handling, security updates for the support period, technical documentation, conformity assessment and CE marking.
The reporting clock
The clock starts when you become aware of the exploitation or the incident, not when you finish investigating it.
| Event | Early warning | Notification | Final report |
|---|---|---|---|
| Actively exploited vulnerability | Within 24 hours | Within 72 hours | No later than 14 days after a corrective or mitigating measure is available |
| Severe incident affecting the product's security | Within 24 hours | Within 72 hours | Within one month after the 72-hour notification |
What is different when you are outside the EU
The obligations are the same as for an EU manufacturer. The mechanics are not.
Which CSIRT gets your report
Without a main establishment in the EU, Article 14(7) sets the order: the member state of your authorised representative, then of your importer, then of your distributor, then the one where most of your users are. Knowing this in advance saves hours on the day.
An authorised representative is optional
Article 18 says a manufacturer may appoint one by written mandate. It is not mandatory. If you appoint one, it can hold your declaration of conformity and technical documentation for market surveillance authorities, but it cannot take over your design and vulnerability handling duties.
Your importers will ask for proof
Under Article 19, an EU importer must check that you carried out the conformity assessment, drew up the technical documentation and applied the CE marking. Expect those requests to reach you well before December 2027.
Penalties apply to you too
Article 64 caps fines for breaching Annex I or Articles 13 and 14 at EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Micro and small enterprises cannot be fined for missing the 24-hour early warning alone.
Self-check: where do you stand?
Eleven questions. Nothing is sent or stored. The result separates what you need today from what you need by December 11, 2027.
Fixed prices, per product
Works with GitHub Actions, GitLab CI, Jenkins or Azure DevOps, on AWS, Google Cloud or Azure. Open, standard tools (CycloneDX or SPDX, Syft, Grype or Trivy, Dependency-Track), so there is nothing proprietary to keep paying for. Prices in USD, excluding taxes.
Free written gap check
$0
- You send a short description of the product and how you sell it in the EU
- You get a written note within five business days: likely in scope or not, likely product class, what is required now, what is due by December 2027
- No call required
CRA reporting readiness pack
$3,500 per product
- Vulnerability intake and triage process, written and wired to your ticketing
- SBOM generated from your CI pipeline for every release, and archived
- 24-hour reporting runbook, tested in a timed dry run
- The contacts and accounts you need on ENISA's single reporting platform, and your coordinator CSIRT identified
Full CRA technical file support
From $6,500 per product
- Everything in the readiness pack
- Vulnerability handling process for Annex I, Part II
- Coordinated disclosure policy and security.txt
- Support period and update mechanism documented
- Risk assessment and technical documentation structured for conformity assessment
How the readiness pack runs
- Week 1: inventory. Read access to the repository and CI. First SBOM, first list of known vulnerabilities, map of the versions still in use, and the EU sales chain (importers, distributors, where your users are).
- Week 2: pipeline and intake. SBOM generation and archiving on every build, dependency monitoring, alerts routed to a named person. Everything lands as pull requests in your repository.
- Week 3: runbook and dry run. The reporting runbook, pre-filled templates for the early warning and the 72-hour notification, platform access, and a timed dry run with your team, in your time zone.
Who you work with
Amine, a freelance DevOps engineer based in France, in the EU. Day-to-day work is AWS, Google Cloud, Azure, Kubernetes and Terraform. You get the same person from the gap check to the dry run, in English, with working hours that overlap US or Asian time zones when needed.
Reprisa is not a law firm, a notified body or an authorised representative. For products in the important or critical categories, the notified body does the assessment; the technical file prepared here is what you hand it.
Frequently asked questions
Does the Cyber Resilience Act apply if we have no office in the EU?
Yes, if you place a product with digital elements on the EU market. The CRA covers products made available in the EU, wherever the manufacturer is based. Since September 11, 2026, Article 14 reporting applies, including to products placed on the market before December 11, 2027.
Do we have to appoint an EU authorised representative?
No. Article 18 says a manufacturer may appoint an authorised representative by written mandate. It is optional. If you have one, its member state comes first when Article 14(7) decides which national CSIRT receives your reports.
What are the CRA reporting deadlines?
For an actively exploited vulnerability: early warning within 24 hours of becoming aware, notification within 72 hours, final report no later than 14 days after a corrective or mitigating measure is available. For a severe incident: 24 hours, 72 hours, and a final report within one month of the 72-hour notification. All through ENISA's single reporting platform.
Is SaaS covered by the CRA?
A pure SaaS service is generally not a product under the CRA. Remote data processing that a product needs to perform one of its functions, such as the cloud backend of a connected device or app, is part of the product.
What are the penalties under the CRA?
Article 64 sets maximum fines. Breaching the essential requirements of Annex I or the obligations in Articles 13 and 14 can cost up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Micro and small enterprises cannot be fined for missing the 24-hour early-warning deadline alone, but they still have to report.
Is Reprisa a law firm or a notified body?
No. Reprisa builds the process, the tooling and the documents. For legal interpretation, use counsel. For products that need third-party conformity assessment, the notified body does the assessment; the technical file we prepare is the input.
Ask for the gap check or a fixed quote
Written reply within one business day. No sales sequence.
Sent. You will get a written reply within one business day.