The CRA reporting duty starts in five weeks. The platform does not

The date everyone is planning for is the wrong one

Ask a product team about the Cyber Resilience Act and you will hear 11 December 2027: essential requirements, conformity assessment, CE marking. That work is real and most of it genuinely belongs in 2027.

It is not the first deadline.

Regulation (EU) 2024/2847, as it actually phases in

1. 10 Dec 2024

   Entry into force

   The clock on everything below starts here.

2. 11 Jun 2026

   Chapter IV applies

   Notification of conformity assessment bodies. Already passed.

3. 11 Sep 2026

   Article 14 reporting applies

   Actively exploited vulnerabilities and severe incidents must be reported. Five weeks away.

4. 11 Dec 2027

   Full application

   Essential requirements, conformity assessment, CE marking, technical documentation.

Two things about September make it harder than the date alone suggests.

It reaches backwards. The reporting obligation applies to products with digital elements already made available on the Union market, including ones placed there long before the CRA existed and never touched since. A 2022 product still in the field, whose team has moved on, is in scope on 11 September whether or not anything about it is otherwise CRA-relevant.

It runs on a 24-hour clock. Early warning to your national CSIRT and ENISA within 24 hours of becoming aware, a fuller notification within 72 hours, then a final report within 14 days for an actively exploited vulnerability or one month for a severe incident.

The platform you must report through is not live

This is the part worth checking yourself rather than taking from me. ENISA's own Single Reporting Platform page, with guidance documents dated 31 July 2026, still describes the platform in the future tense: it shall become a technical tool, and as of 11 September 2026 onwards it will be used by CSIRTs and manufacturers for mandatory reporting.

The practical instruction is dull and it is the whole of it: watch the ENISA SRP page weekly from now, and register the moment access opens rather than the moment you need it.

This is the fourth clock, not the first

Four clocks, four triggers, one incident

The reason to treat this as routine rather than novel is that you have almost certainly done it three times already.

Incident reporting duties now running in parallel

Regime	First deadline	Then	Reported to
CRA Article 14	24 hours, early warning	72 hours, then 14 days or one month	National CSIRT and ENISA
NIS2 Article 23	24 hours, early warning	72 hours, then one month	National CSIRT or competent authority
DORA	4 hours from classifying an incident as major	72 hours, then one month	Competent financial authority
GDPR Article 33	72 hours	None	Supervisory authority

A single incident in a regulated product can now start several of these at once, on different durations, to different recipients. That is an organisational problem before it is a legal one: it is solved by one person holding one decision, not by four teams each reading their own regulation.

The connective point with third-party breach notification is exact. Every clock in the table begins when somebody notices. None of them bounds the interval between compromise and noticing, which is the interval that actually determines exposure.

What the class question changes

Classification is a 2027 problem that has to be answered in 2026, because it decides what evidence you should already be generating.

Finding out at conformity assessment that two products sit in Important Class II is the expensive version of that discovery. It is also entirely avoidable in August 2026.

Who is a manufacturer, which is broader than it sounds

The obligation attaches to manufacturers of products with digital elements, and both halves of that phrase are wider than the words suggest.

A product with digital elements is not only hardware with firmware. Software placed on the market on its own qualifies, which brings in companies that have never considered themselves product businesses at all: a SaaS vendor shipping a downloadable agent, a consultancy licensing a tool it built for one client and then sold to others, an integrator distributing a configured appliance.

And manufacturer is a role rather than a description. Placing a product on the market under your own name makes you one, including where somebody else built it. That is the same trap the AI Act sets with providers, and it catches the same organisations for the same reason.

Two exclusions worth knowing. Free and open-source software developed outside a commercial activity is out of scope, though the boundary is narrower than the enthusiasm for it suggests once monetisation appears. And products already covered by sector rules, such as medical devices, are handled there rather than twice.

If you are unsure which side of the line you are on, the useful question is not whether you feel like a manufacturer. It is whether anything you supply runs on a customer's infrastructure and receives updates from you.

What to do in the five weeks

If the estate question is bigger than the deadline, that is what CRA readiness covers, and the regulatory scope checker works out which of the overlapping regimes apply to you in the first place.