EU Cyber Resilience Act Reporting Starts With Unresolved Agent Rules and an Untested Portal

Europe's first enforceable deadline under the Cyber Resilience Act arrives on 11 September 2026, when manufacturers of connected products must start reporting actively exploited vulnerabilities to ENISA and national CSIRTs within 24 hours of learning of them. EU Cyber Resilience Act reporting takes effect this week for hardware and software already on the EU market, including devices sold long before the rules existed. It is the earliest fully binding piece of Regulation (EU) 2024/2847, which entered into force in December 2024 and does not otherwise apply in full until December 2027.

Once a manufacturer learns that a flaw in one of its products is being exploited, the clock starts. An early warning must reach ENISA and the relevant national Computer Security Incident Response Team within 24 hours. A fuller notification follows inside 72 hours, and a final report is due at 14 days. Article 14 of the regulation sets the reporting framework, and Article 69(3) folds the 24-hour disclosure obligation into it.

The perimeter is broad. The European Commission defines the scope as connectable hardware and software products with digital elements, a category it illustrates with baby monitors, smart watches and applications. Compliant products carry CE marking for sale in the EU, and manufacturers hold security responsibility across the entire product lifecycle rather than at the point of sale.

Two features of the design carry immediate operational weight. Filing goes to two recipients, ENISA and the manufacturer's designated national CSIRT, so a single incident produces parallel submissions. The duty also attaches to the installed base, which pushes engineering teams to inventory what they have already sold.

What EU Cyber Resilience Act Reporting Requires From Today

Reporting is the first of the regulation's obligations to bite. The essential requirements and the conformity assessment regime arrive on 11 December 2027, about 15 months later. Manufacturers therefore get a live reporting duty well before the compliance machinery that normally supports it is fully specified.

The staged design creates a harder internal deadline than the headline figure suggests. The 24-hour early warning is a low-threshold filing, intended to start the notification process before a full technical picture exists. A manufacturer therefore needs a reportability decision within hours of credible knowledge, not within a day.

Reporting also stands apart from remediation. The duty is triggered by awareness that exploitation is under way, not by the availability of a patch, so a manufacturer can be fully compliant with a vulnerability still unpatched and customers still exposed. The reporting path has to run alongside engineering work rather than after it.

The Rules Have No Answer for Autonomous Agents

Connected products increasingly ship with agentic features: software that reads a device's environment and takes action without a person in the loop. The CRA offers no guidance on how that behaviour maps onto its framework, which leaves vendors building agents into smart-home hardware and other connected devices without a settled standard to design against.

The gap is practical. A manufacturer must decide whether an agent action that later proves exploitable triggers the 24-hour duty, and what evidence would persuade a regulator that a notification was complete. The European Commission published implementation guidance in July 2026, but no technical bridge connects agent risk to the legal reporting obligation.

That leaves the interpretation risk with the vendor. A narrow reading treats only classical vulnerabilities as reportable and accepts the regulatory exposure. A broad reading pulls every unexpected agent action into the reporting net and multiplies the filing burden. Neither position is confirmed by the text.

An Untested Portal and a Heavy Documentation Bill

EU Cyber Resilience Act reporting runs through a portal that is scheduled to open the same day filing becomes mandatory. ENISA's Single Reporting Platform is due to be operational on 11 September 2026. The European Commission stated that functional and security testing were still under way in the run-up, and the platform's public web address had not been published in advance. ENISA maintains an FAQ covering the reporting process for filers.

The heavier lift sits inside manufacturers' own systems. A defensible 24-hour warning requires an organisation to reconstruct which product version shipped, when it shipped, and the moment it first had credible knowledge of exploitation. Firms that cannot trace a vulnerability to a specific build, or that date their awareness through informal channels, will find the deadline hard to meet.

End-of-life dependencies widen the exposure. Products built on components that no longer receive upstream patches stay inside the reporting perimeter, and an exploited flaw in an abandoned library remains a reportable event for the manufacturer that shipped it.

Component suppliers sit in an awkward position too. A flaw found in a third-party library reaches the manufacturer that integrated it, and that manufacturer carries the reporting duty even when the fix belongs to someone else. Contract terms that set notification windows between supplier and integrator become part of CRA readiness.

Three Paths, and Which One Holds Up

Manufacturers in scope have a choice about how to spend the next 15 months. The narrowest approach treats the deadline as a legal exercise: counsel drafts notification templates, a named contact holds the ENISA account, and the organisation waits for an incident. That covers the paperwork and misses the substance, because the regulation's core question is evidentiary. No template establishes when a company knew something.

The most expansive approach stands up a dedicated product security incident response capability before December 2027. That fits large vendors with thousands of connected products, and duplicates effort for smaller firms that already run incident response.

The middle path maps the reporting duty onto existing incident response, adds version-level traceability to the release pipeline, and rehearses the 24-hour path before the obligation activates. For most manufacturers in scope, that is the defensible choice, and it is the cheapest of the three. The evidence trail that satisfies Article 14 becomes the groundwork for the conformity assessment arriving in December 2027, so the work is not repeated.

What that looks like in practice:

• A single accountable owner for CRA filings, named before 11 September 2026.
• A release inventory linking every shipped product version to its component dependencies.
• A documented reportability path, including who can authorise a 24-hour warning.
• A rehearsal that files a test notification through the ENISA platform and records how long the process took.

Enterprise buyers have a lever in this. Vendors that cannot produce a version-level inventory of shipped products will struggle to answer security questionnaires with dates attached, and procurement teams reviewing connected hardware for EU deployment have a reason to request that evidence before signing.

Why this matters

The reporting clock is the first test of whether Europe's product security rules work in practice, and it starts with the rules incomplete on agents and the filing platform unproven. Manufacturers that treat 11 September 2026 as a filing formality will find the obligation is really a traceability requirement, and that the 15 months before full application are the only window to build one. The next visible milestone is the portal itself: whether ENISA's platform holds up under first filings, and whether the Commission issues further clarifications on agent behaviour before December 2027.

Sources

Cyber Resilience Act | Shaping Europe's digital future

Cyber Resilience Act - Reporting obligations | Shaping Europe’s digital future

Related Articles

• EU AI Act Article 50 Compliance: 17 Days Until Transparency and Labeling Rules Take Effect
• EU AI Act Article 50 Compliance: Six-Day Countdown to August 2 Transparency Rules
• New Deadlines for EU AI Act Compliance: High-Risk System Requirements Delayed to 2027

✔Human Verified

Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.