Cyber Resilience Act: What Companies Should Prepare Organizationally Now

The reporting obligation under Article 14 of the Cyber Resilience Act has applied since 11 September 2026 and requires an initial notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. Meeting this deadline requires the necessary internal structure to be in place long before the first incident occurs. What matters is not the status of the external reporting platform, but the internal chain from detection to the decision on who reports.

What the reporting obligation requires from 11 September 2026

Manufacturers must report an actively exploited vulnerability or a severe security incident in three steps: an early warning within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure becomes available.

Article 14 of the Cyber Resilience Act requires the first notification without undue delay and in any case within 24 hours of becoming aware of it.

The final report must describe the vulnerability, name any malicious actors involved where applicable, and set out the remediation and possible mitigating measures. For severe incidents unrelated to a vulnerability, the deadline for the final report is one month instead of 14 days.

Why the deadline applies earlier than the ability to meet it

The general manufacturer obligations under Article 13, including technical documentation and conformity assessment, formally apply only from 11 December 2027, while the reporting obligation under Article 14 already came into force 15 months earlier.

This gap means that the process for detecting active exploitation, which is actually part of the Article 13 obligations, must already function even though it is not formally required until later. Companies relying on the later deadline risk a reporting gap that is not caused by the absence of a legal obligation, but by the absence of detection capability.

The catch-up work on reporting obligations and the software bill of materials concerns exactly this gap between the reporting obligation and the documentation obligation.

Was the Single Reporting Platform ready in time?

Ten days before the deadline, on 1 September 2026, the Single Reporting Platform built by ENISA still had no published URL on the public internet, even though it was meant to go live together with the reporting obligation on 11 September 2026.

According to ENISA, the platform also offers no programming interface at launch, meaning every mandatory notification must go through the web portal. In addition, the list of national CSIRT designated as coordinators remained unsettled for a long time, which collided with the registration process that requires selecting a competent CSIRT from that list.

Under Implementing Regulation (EU) 2026/881, issued on 11 December 2025, the decision on whether to withhold reporting content when forwarding it to ENISA lies with the receiving CSIRT.

Which internal responsibilities must be in place before the first notification

Regardless of the status of the external platform, companies must already know the CSIRT competent for their main establishment and have an internal triage process that compiles the content for the early warning, notification and final report on the required schedule.

The decision on whether to trigger a notification rarely rests with a single person. It requires a predefined division of roles between the security team, legal department and executive management. This escalation chain for a 24-hour notification must be in place before an incident triggers the deadline, otherwise the available time is used up by internal coordination.

• Detection: who technically establishes active exploitation
• Decision: who assesses within hours whether a reporting obligation has been triggered
• Content: who supplies the information for the 24-hour, 72-hour and 14-day stages
• Submission: who operates the web portal of the reporting platform without an automated interface

What this means for Swiss manufacturers with EU market exposure

Swiss companies that sell products with digital elements in the EU or the EEA fall under the Cyber Resilience Act regardless of where they are based, while Switzerland itself has no comparable horizontal cybersecurity law.

This means the internal process for meeting the deadline cannot wait for a later Swiss regulation, but must follow the EU requirement as soon as a product enters that market. The further requirements of the Cyber Resilience Act concern not only the reporting deadline but also conformity assessment and CE marking.

A first, verifiable step is to determine the competent CSIRT for each affected product based on the EU main establishment, and to run through the internal reporting chain as a test before a real incident triggers the deadline.