The Cyber Resilience Act is often perceived as a set of rules for late 2027. For manufacturers of digital products, however, a crucial part begins earlier: from 11 September 2026, actively exploited vulnerabilities and severe security incidents must be reported. This turns technical vulnerability management into a binding organisational process with very short response times.
The first deadline arrives before full application
The Cyber Resilience Act entered into force on 10 December 2024. Its key product requirements generally apply from 11 December 2027. However, the European Commission identifies the reporting obligations as applying from 11 September 2026.
They affect manufacturers of “products with digital elements” — in principle, hardware and software made commercially available with a direct or indirect connection to devices or networks. In healthcare, this can include providers of platforms, applications, components and connected systems.
Medical devices and in-vitro diagnostic medical devices to which the MDR or IVDR applies are expressly excluded from the CRA’s scope pursuant to Article 2(2). For platforms, general software, infrastructure components and connected digital services in healthcare, classification must instead be assessed product by product.
Important: The reporting obligations do not apply only to new products. Article 69(3) generally also covers products within the CRA’s scope that were placed on the market before 11 December 2027.
24 hours, 72 hours and a robust final report
The European Commission describes a staged process for reportable cases:
- Within 24 hours of the manufacturer becoming aware, an early warning must be submitted.
- Within 72 hours of the manufacturer becoming aware, a more detailed notification follows — unless the relevant information has already been submitted in full. Depending on the case, it includes available information on the affected product; the general nature of the exploit or vulnerability; or the nature and initial assessment of the incident, as well as corrective and remedial measures already taken or recommended.
- For a security incident, the final report follows no later than one month after submission of the 72-hour notification.
- For an actively exploited vulnerability, a separate deadline applies to the final report: no later than 14 days after a corrective or remedial measure becomes available.
Reports are submitted via the central CRA reporting platform being established by ENISA. It is intended to be operational by 11 September 2026. The report is addressed to the competent Computer Security Incident Response Team and is generally also made available to ENISA.
Why this also matters to hospitals and healthcare organisations
The immediate reporting obligation lies with the relevant manufacturer. Hospitals, medical care centres, healthcare organisations and other operators of digital systems nevertheless remain part of the process. Security incidents are often detected first in operations. Without clear contact channels, contractual arrangements and usable log data, manufacturers can scarcely meet the tight deadlines.
This creates a new quality question for procurement and supplier management: not only “Is the product secure?”, but also “Can the provider detect, classify and report an incident in compliance with the rules within a few hours?”
Unclear responsibilities between manufacturer, hosting partner, IT service provider and operator are particularly critical. When everyone sees only part of the picture, time is lost precisely where the regulation requires rapid, reliable information.
CRA and NIS2: what is the difference?
The CRA and NIS2 address different levels of cybersecurity. The Cyber Resilience Act sets requirements for products with digital elements and addresses the reporting obligations described here to their manufacturers. NIS2, by contrast, requires covered entities and companies in certain sectors to manage cyber risks and maintain organisational response capability.
In practice, the two regimes may meet in the supply chain: a hospital may need to manage security incidents organisationally as a NIS2 entity, while a manufacturer fulfils CRA obligations in parallel for an affected digital product. Coordinated roles, reporting channels and reliable information between operator and manufacturer are therefore essential.
What should be prepared now
- Clarify products and roles: Which digital products are manufactured in-house or offered under the organisation’s own brand? Where is the organisation only an operator, importer, distributor or service provider?
- Define the reporting chain: Who assesses a vulnerability, who decides on reporting, and who compiles the information required within 24 or 72 hours?
- Review supplier processes: Contracts and escalation paths should ensure that operators, manufacturers and technical partners exchange relevant incidents without delay.
- Run a test: A tabletop exercise using a realistic vulnerability or incident scenario shows whether detection, assessment, communication and documentation actually work within the deadlines.
Frequently asked questions about the Cyber Resilience Act
Does the Cyber Resilience Act apply to hospitals?
Not solely because they operate a hospital. The CRA’s immediate obligations primarily affect manufacturers and other economic operators of products with digital elements. Hospitals may nevertheless be involved indirectly through procurement, supplier communication and incident detection — or directly if they develop a covered product themselves and place it on the market under their own name.
Do medical devices fall under the CRA?
Products with digital elements to which the MDR or IVDR applies are excluded from the CRA pursuant to Article 2(2). General software, platforms, infrastructure components and connected services in healthcare, by contrast, must be assessed product by product.
Which CRA reporting obligations apply from 11 September 2026?
Manufacturers must generally issue an early warning on actively exploited vulnerabilities and severe security incidents within 24 hours, and provide more detailed information within 72 hours unless it is already available in full. The deadlines for the applicable final report then apply depending on the case.
What is the difference between the CRA and NIS2?
The CRA focuses on the cybersecurity of digital products and the obligations of their manufacturers. NIS2 focuses on the cyber-risk management of covered entities and companies in certain sectors. Both regulatory regimes can be relevant at the same time in supply chains.
Conclusion: compliance begins with operational response capability
The Cyber Resilience Act requires more than secure product development. From September 2026, it will become apparent whether companies can handle vulnerabilities and incidents in a structured way under time pressure. Those who wait until the first real attack to clarify roles, responsibilities and information channels will lose valuable hours.
For healthcare organisations, the consequence is clear: cybersecurity must be organised across product, supplier and operational boundaries. Reporting capability is therefore not merely a legal issue, but a test of operational resilience.
Primary sources and validity limit
- European Commission: CRA reporting obligations, accessed 26 August 2026. Evidence for reportable matters, deadlines, the platform and the reporting process.
- European Commission: Cyber Resilience Act summary, accessed 26 August 2026. Evidence for the scope, transitional rules and the coverage of products already placed on the market under Article 14.
- European Commission: Cyber Resilience Act, accessed 26 August 2026. Evidence for the timetable and general framework of application.
- Regulation (EU) 2024/2847 on horizontal cybersecurity requirements, official EU legal act. Articles 2, 14, 69 and 71 are particularly relevant.