In the first hours of an incident?
Speak to counsel — +351 919 497 920 — monitored outside working hours · first steps01What it is
The CRA imposes cybersecurity requirements on products with digital elements placed on the EU market — essential requirements, conformity assessment, CE marking, technical documentation and vulnerability handling across the support period.
Most planning is anchored to 11 December 2027, when the Regulation applies in full. For reporting, that is the wrong date.
Article 14 has applied since 11 September 2026. Article 69(2) provides that products placed on the market before 11 December 2027 fall under the Regulation only if substantially modified from that date. Read alone, it suggests the existing catalogue is untouched. Article 69(3) carves the reporting obligations back out of that rule. A product placed on the market years ago, never modified, still supported — the reporting duty reaches it.
02Who it applies to
Manufacturers of products with digital elements placed on the EU market, and — with narrower duties — importers and distributors. “Products with digital elements” covers hardware and software, including software supplied commercially on its own.
The scope is wider than the hardware manufacturers who feature in most of the commentary. A software vendor is a manufacturer for these purposes.
03Core obligations
04Timeline
05Where it meets the other regimes
CRA ↔ NIS2 — the same 24 hours, different recipients
Both regimes count 24 hours from awareness. NIS2 sends an early warning to the national CSIRT for significant incidents affecting the entity's service. The CRA sends notification to ENISA and the coordinating CSIRT for actively exploited vulnerabilities and severe incidents affecting the product. An entity that both operates in a NIS2 sector and manufactures products can owe both duties for one event, assessed against different tests.
CRA ↔ GDPR — different trigger, different clock
The CRA duty attaches to an actively exploited vulnerability or a severe incident affecting the product. The GDPR duty attaches to a personal data breach likely to result in a risk, within 72 hours. A vulnerability being exploited in the wild may involve no personal data at all, and a personal data breach may involve no product vulnerability. Where both are engaged, two assessments run in parallel against different criteria.
CRA ↔ AI Act
Where an AI system is embedded in a product with digital elements, both regimes reach the same object. The AI Act's Annex I high-risk obligations, which run to 2 August 2028, attach to systems embedded in products already subject to Union harmonisation legislation — of which the CRA is now one.
The practical problem: you cannot report what you cannot detect
A 24-hour clock assumes someone is watching, that the escalation path exists, and that the judgement on 'actively exploited' can be made in hours rather than days. For most manufacturers the difficulty is not the filing; it is knowing, on the day, that there is something to file.
06What we are instructed on
CRA scope analysis, vulnerability handling and disclosure policies, reporting readiness, conformity assessment preparation, and the contractual position with component suppliers.
Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.