On 11 September 2026 the reporting obligations in the Cyber Resilience Act — Regulation (EU) 2024/2847 — start to apply. The regulation's heavier product requirements do not arrive until December 2027, and that has led a lot of companies to file the whole thing under next year.
That is a mistake, for one simple reason: the reporting duty covers products already placed on the market. This is not a question about what you build next. It is a question about what you have already shipped.
What the Cyber Resilience Act requires from 11 September
From 11 September, a manufacturer of products with digital elements must report two things:
Actively exploited vulnerabilities in the product — meaning vulnerabilities the manufacturer has grounds to believe are being exploited, not merely that they exist. And severe incidents affecting the security of the product.
The report goes to ENISA and the CSIRT designated as coordinator in the Member State where the manufacturer has its main establishment. It is filed once, through the CRA's single reporting platform, and made available to both recipients from there.
The clocks are short:
- 24 hours — early warning, from becoming aware.
- 72 hours — full notification.
- 14 days — final report for actively exploited vulnerabilities, counted from when a corrective measure is available.
- One month — final report for severe incidents, counted from the 72-hour notification.
Are you in scope? The CRA covers products with digital elements placed on the market: distributed software, hardware containing software, and remote data processing solutions necessary for the product to function. Pure cloud services delivered as a service largely fall outside — but the boundary is not always obvious, particularly for anyone shipping both an installed client and a service behind it.
The same recipient, by two entirely different routes
This is the part that causes trouble in practice. Since 1 July 2026 the incident reporting regulations under Sweden’s Cybersecurity Act have applied, and many Swedish companies have built an incident process against them. That process does not satisfy the CRA.
What makes it confusing is that both end up at the same authority. Sweden’s national CSIRT is CERT-SE, which on 1 July 2026 moved from the Swedish Civil Defence Agency to the National Cyber Security Centre at FRA — the same date the Cybersecurity Act’s incident reporting took effect. A report under either regime lands in the same building.
The route, however, is not the same. A Cybersecurity Act notification goes directly to the NCSC. A CRA report is filed in ENISA’s single reporting platform, where you select the CSIRT designated as coordinator — for a company whose main establishment is in Sweden, that is CERT-SE. The platform then forwards it to both the CSIRT and ENISA. Two separate filings, different evidence, different clocks.
| Swedish Cybersecurity Act | Cyber Resilience Act | |
|---|---|---|
| Your role | Operator | Manufacturer |
| Triggered by | An incident affecting the service you deliver | An actively exploited vulnerability or severe incident in the product you placed on the market |
| Filed through | Directly with the NCSC at FRA | ENISA’s single reporting platform, which forwards to CERT-SE and ENISA |
| In force since | 1 July 2026 | 11 September 2026 |
A Swedish software company operating in a covered sector can therefore hold both duties at once, and one does not substitute for the other. The critical difference is not the deadline but the trigger: the CRA can force a report about your product, at your customers' sites, while your own operations are entirely unaffected. No alarm goes off in your environment. The signal arrives from outside — a security researcher, a customer, a CVE feed.
Update 1 October 2026: ENISA’s single reporting platform went live on 11 September 2026, the same day the obligation started to apply. When this article was first published on 3 September it was not yet operational, and the advice stands: what takes time is not the tool but knowing what you have placed on the market, detecting that something is being exploited, and being able to decide within twenty-four hours. Confirm which CSIRT is your coordinator and register on the platform before you need it.
What needs to be in place
Four things, none of which takes weeks.
1. Determine which role or roles you hold. Operator, manufacturer, or both. Write down the conclusion and the reasoning behind it. That note is what a supervisory authority will ask for — not your recollection after the fact.
2. Inventory what you have actually placed on the market. Including older versions still running at customer sites. If that list cannot be produced today, it cannot be produced within 24 hours either.
3. Name the person who makes the call. Twenty-four hours is short, and some of it usually falls on a weekend. Decide in advance who determines whether something is reportable, and who deputises. A decision requiring three people to be reachable is not a decision that meets the deadline.
4. Give your incident process two exits. One intake, the same initial triage, then two separate reporting paths with different recipients. Building two parallel processes creates duplicated work that quietly dies within a year.
What the CRA and the Cybersecurity Act have in common
The underlying evidence is the same for both paths: knowing what you have, detecting when something happens, and being able to show afterwards what you knew and when. Those are the same three capabilities ISO 27001 and the Cybersecurity Act rest on, which is why anyone with a working management system already has a shorter route here than someone starting from nothing.
The CRA is not a framework in Compeas, and you should not expect it to become one. But timestamped evidence that holds up when someone asks after the fact is the same work regardless of which regulation is doing the asking.
If you would rather start with what actually applies to your operations this autumn: the Cybersecurity Act checklist walks through the requirements in order, with the dates each took effect. Registering your organisation is done as soon as possible with the NCSC at FRA — here is how.
Sources
- Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements, Article 14
- European Commission, Cyber Resilience Act — Reporting obligations, digital-strategy.ec.europa.eu
- The Swedish Cybersecurity Act (2025:1506); CERT-SE as Sweden’s national CSIRT, at the National Cyber Security Centre, FRA, since 1 July 2026
- ENISA, Single Reporting Platform — status as of June 2026