We email you if this date moves, is postponed, or its status changes — nothing else. Free, and independent of your company profile.
One rule, one address. Unsubscribe with one click from any email.
What changes
Manufacturers of products with digital elements (hardware and software, including SaaS-connected devices and standalone apps) must report actively exploited vulnerabilities and severe security incidents through ENISA's single reporting platform: early warning within 24 hours, full notification within 72 hours, final report within 14 days (vulnerabilities) or one month (incidents). It applies to products already on the market.
Who is affected
Manufacturers that place a 'product with digital elements' on the EU market as a distinct product — connected/embedded hardware, distributable/installable software, firmware, and apps a manufacturer ships with a device — including small vendors and commercially-run open source. A pure browser-delivered SaaS with no distributed installable product is generally OUT of CRA scope per Recitals 11-12 (standalone remote data-processing solutions are excluded); the flags below can only approximate this distinction, so read this note rather than relying on the tags alone if you sell software purely as a hosted service.
Sizes: micro, small, medium, large · Sectors: Software / SaaS, Hardware / electronics, Manufacturing · Applies if: We make connected hardware / devices
What to do
Set up an internal process to detect and triage exploited vulnerabilities and incidents in your products. Register on the ENISA single reporting platform and identify your national CSIRT. Draft report templates and an on-call rota so you can meet the 24h/72h clocks. Inform affected users of fixes.
Manufacturers, importers and distributors that place a 'product with digital elements' on the EU market as a distinct product — connected hardware, distributable/installable software, firmware, and client apps a manufacturer ships with a device — including IoT makers and app developers. A pure browser-delivered SaaS with no distributed installable product is generally OUT of CRA scope per Recitals 11-12 (standalone remote data-processing solutions are excluded); the flags below can only approximate this distinction, so read this note rather than relying on the tags alone if you sell software purely as a hosted service.