What happened?
Since September 11, 2026, the first concrete reporting obligations under the Cyber Resilience Act (CRA) have been in effect. Manufacturers of products with digital elements must now report actively exploited vulnerabilities as well as severe security incidents. However, a representative survey by the industry association Bitkom shows that only 29 percent of companies in Germany can assess the significance of the EU regulation for their own organization. A further 38 percent have heard of the regulatory framework but do not understand its consequences. 28 percent are not familiar with the CRA at all.
The Details
The Cyber Resilience Act obligates manufacturers of products with digital elements to meet minimum cybersecurity standards. This applies not only to connected devices such as routers or industrial control systems, but also to software. Most of the substantive requirements will only apply to products newly placed on the EU market starting December 11, 2027. However, the reporting obligations that have now come into effect already apply to the current period.
The reporting timeline is tight:
- An early warning is due within 24 hours of becoming aware of an incident.
- Within 72 hours, manufacturers must submit further information and an initial assessment.
- For vulnerabilities, a final report follows no later than 14 days after a remediation measure – such as a patch or workaround – becomes available.
- For severe security incidents, one month is allowed after the 72-hour report.
The EU agency ENISA operates the central Single Reporting Platform for these notifications. Manufacturers can submit their reports there once; the information is then forwarded to the responsible national CSIRTs as well as to ENISA. However, Bitkom criticizes the fact that companies were unable to register on the platform or test their processes beforehand – the platform only went online when the reporting obligation took effect.
The Bitkom survey, for which 1,003 companies with at least ten employees and an annual revenue of at least one million euros were surveyed by telephone, primarily captures awareness of the CRA. It does not answer how many companies have already practically established their reporting channels, responsibilities, or vulnerability processes.
Context
This development is particularly relevant for the security technology industry: alarm systems, video surveillance systems, and access control systems are today predominantly connected products with digital elements and therefore fall within the scope of the CRA. Manufacturers of such systems – from IP cameras and alarm control panels to access control terminals – must therefore address the new reporting obligations as soon as an actively exploited vulnerability in their products becomes known.
The reporting obligation is primarily aimed at manufacturers who develop such hardware or software or market it under their own brand. For pure user companies, such as security service providers or installation companies that merely deploy third-party products, the question of their own applicability is likely less pressing – though it remains relevant, since distribution brands can also be considered manufacturers under the regulation.
Practical Tips
For affected manufacturers, the new deadline primarily means organizational pressure. Within a very short time, they must be able to determine whether a vulnerability is actually being actively exploited, which products and versions are affected, and who approves the report internally. According to the approaches mentioned in the source material, the following points are particularly important:
- Build a reliable inventory of in-house software and purchased components – without this, it is almost impossible to clarify exposure within 24 hours.
- Maintain a Software Bill of Materials (SBOM) to document components and their origins in a traceable manner.
- Establish structured processes for vulnerability handling so that reporting channels and responsibilities are clear in an emergency.
- Ensure traceable assignment of security updates to the delivered product versions.
Such measures not only help with later proof of conformity but are also a prerequisite for quickly containing the scope of an incident in the event of an actively exploited vulnerability – whether in connected cameras, alarm control panels, or other security technology components.
Outlook
The reporting obligations that have now come into effect are just the beginning: most of the substantive requirements of the CRA will only take effect for products newly placed on the EU market starting December 11, 2027. Until then, manufacturers have time to build and test their internal processes. However, given the low level of awareness about the concrete consequences of the regulation identified by Bitkom, the need for action in many companies in the security technology industry is likely greater than previously assumed. The BSI (Germany's Federal Office for Information Security) provides an overview of the scope of application, while the iX articles on the Cyber Resilience Act mentioned in the source material offer further technical and organizational guidance.
