Share on LinkedInShare on LinkedIn

ARTICLE · 20 OCTOBER 2026

CRA Reporting Obligations: The 24-hour Clock Is Ticking, But When Does It Start?

When a cybersecurity incident strikes on a Friday afternoon, manufacturers of digital products face a critical 24-hour window to report under the EU's Cyber Resilience Act. With penalties reaching EUR 15 million or 2.5% of global revenue, understanding when the notification clock starts ticking has become a high-stakes compliance challenge that demands immediate attention and careful preparation.

AustriaCorporate/Commercial Law

On Friday at 4.30 p.m., within regular business hours, a customer reports that unknown processes are running on several devices and that data is being exfiltrated. Under the Cyber Resilience Act, a notification on Monday may already be late. 

While most CRA obligations take effect on 11 December 2027, manufacturers of products with digital elements have been required to submit notification within 24 hours since 11 September 2026 Infringements can be penalised with fines of up to EUR 15 million or 2.5% of global annual revenue. 

It is therefore crucial to determine when the deadline begins. The European Commission's guidance clearly states that the deadline does not begin only after the matter has been fully investigated, but rather as soon as an immediate initial assessment establishes a "sufficient degree of certainty" that a vulnerability in the manufacturer's own product is being exploited. 

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from