EU Cyber Resilience Act: Reporting Duties for Product Makers
Under the EU Cyber Resilience Act, reporting obligations for manufacturers apply from 11 September 2026. Here is what product makers should prepare now.
In this article
The EU Cyber Resilience Act sets security rules for products with digital elements sold in the EU. That covers a wide range of hardware and software, from connected devices to many software products. For companies that build these products, including many in India that sell into Europe, it changes how security is handled across the product lifecycle.
One part arrives earlier than the rest. The reporting obligations for manufacturers apply from 11 September 2026. This guide focuses on that part: what manufacturers will need to report, who should own it and how to prepare a process that works when it matters.
1. What the reporting duty covers
In general terms, the Act requires manufacturers to report actively exploited vulnerabilities in their products, and severe incidents that affect the security of their products, to the authorities named in the law. It also expects manufacturers to inform users where needed, so that they can protect themselves.
The reports have short deadlines and follow a staged approach, with an early warning followed by more detail. Check the official text for the exact deadlines, the content of each report and the reporting channel, because those details decide how your process must work. Do not rely on summaries that may be out of date.
The key point is that the duty applies to the products you place on the EU market, wherever your company is based. If you sell into Europe, assume the reporting duty will reach you and plan for it.
2. Build the reporting process
A reporting duty with short deadlines only works if the steps are clear and practised. A simple sequence helps.
Know your products.
Keep a list of the products you sell in the EU, their versions and the components they rely on, including open source libraries.
Create intake channels.
Make it easy for researchers, customers and partners to report security issues to you, and monitor those channels every day.
Triage quickly.
Decide fast whether a report describes a real vulnerability, whether it is being actively exploited and which products and versions are affected.
Escalate to an owner.
Name a person who decides whether a report to the authorities is needed and who signs it off, with a deputy for holidays.
Prepare templates.
Draft the early warning and follow-up reports in advance, so that the team fills in facts rather than writing from scratch.
Inform users.
Prepare plain-language advisories that explain the issue and what users should do.
Write the process down in a short document and keep it where the team can find it during an incident. Test it with a realistic scenario at least once before the obligation applies.
3. Prepare the wider product security habits
Reporting is the visible end of a longer chain. To report well, you need to find vulnerabilities, understand them and fix them. Those habits also matter for the rest of the Act, which applies later.
Start with a software bill of materials, a list of the components inside each product. When a vulnerability appears in a common library, you can then check quickly which of your products are affected. Without that list, the first hours of an incident are spent searching.
Set up a vulnerability disclosure policy. Publish how people can report issues to you, what they can expect in return and how you will handle their report. Researchers are more likely to come to you first when the route is clear.
Test your products regularly. Vulnerability assessments and penetration tests find weaknesses before attackers do, and they give you practice in assessing and fixing issues. Our VAPT services article explains how testing works for web, mobile and API products.
Plan updates. When you fix a vulnerability, users need a way to receive the fix. A reliable update mechanism, with clear release notes, is part of good product security and part of what the Act expects.
Finally, assign ownership at the right level. Product security touches engineering, support, legal and leadership. A named product security owner, with the authority to make decisions under time pressure, makes the reporting duty manageable.
Keep a short log of each report you make and each advisory you publish. Over time it shows how quickly you respond, and it helps you improve the process. It also gives leadership a clear view of how product security is going.
If you build products for the EU market and want to prepare for the reporting duty, our VAPT team and regulatory audits team can help you test your products and design the process. We would be glad to talk.