BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//EU Deadline Radar//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:EU Deadline Radar
NAME:EU Deadline Radar
BEGIN:VEVENT
UID:cra-vulnerability-incident-reporting@eudeadlines.eu
DTSTAMP:20261025T052034Z
DTSTART;VALUE=DATE:20260911
DTEND;VALUE=DATE:20260912
SUMMARY:Cyber Resilience Act: CRA: mandatory reporting of actively exploite
 d vulnerabilities and severe incidents to ENISA/CSIRT
DESCRIPTION:Manufacturers of products with digital elements (hardware and s
 oftware\, including SaaS-connected devices and standalone apps) must repor
 t actively exploited vulnerabilities and severe security incidents through
  ENISA's single reporting platform: early warning within 24 hours\, full n
 otification within 72 hours\, final report within 14 days (vulnerabilities
 ) or one month (incidents). It applies to products already on the market.\
 n\nWho is affected: Manufacturers that place a 'product with digital eleme
 nts' on the EU market as a distinct product — connected/embedded hardwar
 e\, distributable/installable software\, firmware\, and apps a manufacture
 r ships with a device — including small vendors and commercially-run ope
 n source. A pure browser-delivered SaaS with no distributed installable pr
 oduct is generally OUT of CRA scope per Recitals 11-12 (standalone remote 
 data-processing solutions are excluded)\; the flags below can only approxi
 mate this distinction\, so read this note rather than relying on the tags 
 alone if you sell software purely as a hosted service.\n\nWhat to do: Set 
 up an internal process to detect and triage exploited vulnerabilities and 
 incidents in your products. Register on the ENISA single reporting platfor
 m and identify your national CSIRT. Draft report templates and an on-call 
 rota so you can meet the 24h/72h clocks. Inform affected users of fixes.\n
 \nPenalty: Up to €15M or 2.5% of worldwide turnover\n\n\nStatus: In forc
 e\nhttps://eudeadlines.eu/deadline/cra-vulnerability-incident-reporting
URL:https://eudeadlines.eu/deadline/cra-vulnerability-incident-reporting
CATEGORIES:EU,Cyber Resilience Act
LAST-MODIFIED:20261001T000000Z
TRANSP:TRANSPARENT
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:Cyber Resilience Act: CRA: mandatory reporting of actively expl
 oited vulnerabilities and severe incidents to ENISA/CSIRT — due in 7 day
 s
TRIGGER;VALUE=DURATION:-P6DT15H
END:VALARM
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:Cyber Resilience Act: CRA: mandatory reporting of actively expl
 oited vulnerabilities and severe incidents to ENISA/CSIRT — due in 1 day
TRIGGER;VALUE=DURATION:-PT15H
END:VALARM
END:VEVENT
END:VCALENDAR