The short answer
The first operational obligation of the CRA now applies: reporting. If you become aware of an actively exploited vulnerability in your product, or a severe incident affecting its security, you must notify ENISA and the competent national CSIRT through the Single Reporting Platform within strict deadlines.
Most other obligations - security-by-design requirements, SBOM, vulnerability handling and CE marking under the CRA - apply from 11 December 2027.
The deadlines
- Early warning: within 24 hours of becoming aware.
- Detailed notification: within 72 hours.
- Final report: for vulnerabilities, within 14 days after a fix or mitigation is available; for incidents, within one month after the notification.
Products already on the market are included
The reporting obligation covers products placed on the market before 11 September 2026. For many manufacturers this is the first time older product lines need a defined security response process.
Penalties
Breaching the reporting obligations can lead to fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher.
What embedded teams should do now
- Publish a security contact and a short vulnerability disclosure policy.
- Agree who files the 24-hour early warning and prepare templates for the 72-hour notification.
- Know which firmware versions are in the field and which components they contain (SBOM).
- Check that you can deliver a signed update to devices already installed.
Next steps
Our free CRA engineering checklist turns these obligations into concrete engineering checks. If you want an outside view, book a CRA gap analysis.
This article describes engineering implications. It is not legal advice.