# Cyber Resilience Act: Where the Gaps Actually Are > SwissGRC erklärt GRC-Verantwortlichen, welche Nachweise der Cyber Resilience Act verlangt: eine 24-Stunden-Meldekette ab 11 September 2026 und ein aktuelles, maschinenlesbares SBOM inklusive Lieferantenangaben vor dem 11 Dezember 2027. - URL: https://swissgrc.com/ar/cyber-resilience-act-gaps-reporting-obligations-sbom/ - الناشر: SwissGRC® - تاريخ النشر: 2026-08-26 - آخر تحديث: 2026-09-17 ## معلومات أساسية - The Cyber Resilience Act entered into force on 10 December 2024, the reporting obligation applies from 11 September 2026, and the regulation applies in full from 11 December 2027. - Under Article 14 CRA, manufacturers must send an early warning within 24 hours and a follow-up notification within 72 hours for actively exploited vulnerabilities and severe security incidents. - According to an ONEKEY survey cited by heise online, 45 percent of the companies surveyed are barely or not at all familiar with the CRA requirements. - In the same survey, only 18 percent of suppliers provide manufacturers with the necessary CRA information, although manufacturers remain liable for supplied components. - The CRA does not mandate a single SBOM format; CycloneDX and SPDX have become established, and the SBOM should be tightly coupled to build and release processes. - The next verifiable step is a complete product inventory that records for each product whether a machine-readable SBOM exists and which suppliers must still provide information. The Cyber Resilience Act enters into full application on 11 December 2027, but the decisive groundwork is being laid well before that date. A recent survey reported by heise online shows that many companies are still not sufficiently familiar with the requirements on reporting obligations and software bills of materials. For governance, risk and compliance functions, the question is no longer whether the CRA is relevant, but which evidence must actually be in place by the next deadlines, and who is responsible for providing it. In short Until the Cyber Resilience Act applies in full on 11 December 2027, companies need to prepare two things above all: a working 24-hour reporting chain for actively exploited vulnerabilities from 11 September 2026, and a current, machine-readable software bill of materials that includes information from suppliers. Both require documented processes, not preparation shortly before the deadline. 45% of the companies surveyed are barely or not at all familiar with the CRA requirements ONEKEY survey, cited by heise online, 25 August 2026 18% of suppliers provide the necessary CRA information to manufacturers ONEKEY survey, cited by heise online, 25 August 2026 24hrs. deadline for the early warning of an actively exploited vulnerability Regulation (EU) 2024/2847, Art. 14 ## How far has industry actually progressed with CRA implementation? According to a survey by cybersecurity provider ONEKEY cited by heise online, 45 percent of the companies surveyed are barely or not at all familiar with the CRA requirements. A second finding carries more weight further down the supply chain: according to the same survey, only 18 percent of suppliers provide the necessary CRA information, even though manufacturers remain liable for supplied components as well. The real risk therefore lies less in a company’s own development department than in the chain of upstream suppliers. Nevertheless, a third of companies state that they intend to meet all requirements by the December 2027 deadline, according to heise online. In many cases, a gap remains between this ambition and documented preparation. Similar uncertainty about the actual scope of application also shows up under other EU legislation, as the article “NIS2-Registrierungslücke: Was sie über Scope-Unsicherheit zeigt” illustrates. ## Which deadlines lie between now and full application? The Cyber Resilience Act entered into force on 10 December 2024, the reporting obligation for vulnerabilities and incidents applies from 11 September 2026, and the regulation applies in full from 11 December 2027. The real preparation time falls between these dates. Companies that want to meet the reporting obligation from September 2026 need a working detection and escalation chain in place by that date, not a draft of one. Full compliance, including the SBOM obligation, follows just over a year later, but the processes required for it cannot be built in the final weeks before the deadline. The German Federal Office for Information Security (BSI) accompanies this transition period with a technical guideline that specifies requirements for SBOM and reporting, but this guideline does not replace a company’s own risk assessment. ![Dashboard view of IT-Grundschutz: left navigation with sections, middle questionnaire form, and right progress gauge at 33%.](https://swissgrc.com/wp-content/uploads/sites/5/2026/08/Control-Assessment-1024x620-1.png) Control Assessment in der SwissGRC Plattform ## What does the reporting obligation under Article 14 CRA actually require? Manufacturers must report actively exploited vulnerabilities and severe security incidents to the competent coordinating authority and to ENISA, with an early warning within 24 hours and a follow-up notification within 72 hours. Both notifications go through the single reporting platform provided for under the CRA, which forwards them simultaneously to the coordinating CSIRT and to ENISA. The clock starts when the manufacturer becomes aware of the issue, not when a specialist department or an external reporter confirms it. For a GRC function, this means the escalation paths within the 24-hour deadline must be documented in writing and rehearsed before the September 2026 deadline is reached. How strongly such a reporting chain depends on rehearsed processes rather than on technology alone is described in the article “ISMS: Menschen, Prozesse und Technologie sind entscheidend”. ## Which evidence for the software bill of materials is most often still missing? The SBOM is part of the technical documentation and must cover at least the direct software dependencies, yet many companies are missing precisely this information for supplied components. The CRA does not mandate a single technical format; in practice, CycloneDX and SPDX have become established. What matters is less the format than currency: an SBOM created once loses relevance with every software update and should be tightly coupled to build and release processes. The finding on suppliers applies directly here: without reliable information from the supply chain, a company’s own SBOM remains incomplete, regardless of how well internal documentation is organised. How such dependencies on third parties can be captured systematically is described in the article “Was das Third-Party Cyber Risk Management von etablierten Sicherheitsfunktionen lernen kann”. ## Which first step can be scheduled concretely right now? The next verifiable step is a complete product inventory that records, for each product, whether a machine-readable SBOM exists and which suppliers still need to provide missing information. Security or compliance officers should have a documented escalation process for actively exploited vulnerabilities in place by the 11 September 2026 deadline, including access to the reporting platform and a named owner for the 24-hour deadline. In parallel, it is worth taking stock of which products and suppliers currently have machine-readable SBOM data at all. Because CRA notifications are product-related while other regimes such as NIS2 report at the organisational level, it is also worth looking at the interfaces between the two obligations, as the article “Cyber Resilienz neu denken im Kontext von NIS2” sets out. Companies that begin this stock-take now still have time before the September 2026 deadline for a test run of the reporting chain. For practice ## Key points - The reporting obligation under Article 14 CRA already applies from 11 September 2026 and requires an early warning within 24 hours. - A working escalation chain with access to the reporting platform must be in place before this deadline, not built afterwards. - Suppliers currently often fail to provide the necessary CRA information, even though manufacturers are liable for supplied components. - An SBOM quickly loses relevance without being coupled to build and release processes and must be updated continuously. - A complete product inventory with SBOM status per product is the next verifiable step before the December 2027 deadline. FAQ ## Frequently asked questions From when does the Cyber Resilience Act's reporting obligation apply? The reporting obligation under Article 14 CRA applies from 11 September 2026. Manufacturers must report actively exploited vulnerabilities and severe security incidents as an early warning within 24 hours and as a follow-up notification within 72 hours, via the single reporting platform, to the coordinating authority and to ENISA. The clock starts when the manufacturer becomes aware of the issue. Which formats are used for the SBOM under the CRA? The Cyber Resilience Act does not mandate a specific technical format for the software bill of materials. In practice, CycloneDX and SPDX have become established. What matters is less the chosen format than the currency of the SBOM, which should be tightly coupled to build and release processes so it remains meaningful after updates. When does the Cyber Resilience Act apply in full? The Cyber Resilience Act entered into force on 10 December 2024 and applies in full from 11 December 2027. In between lies the reporting obligation for vulnerabilities and incidents, which already applies from 11 September 2026 and requires corresponding processes to be in place early. Who is liable for vulnerabilities in supplied components under the CRA? Under the Cyber Resilience Act, manufacturers are also liable for vulnerabilities in supplied components. According to a survey cited by heise online, however, only 18 percent of suppliers provide the necessary CRA information, so companies need to actively request the missing information from their supply chain. What role does the BSI play in implementing the Cyber Resilience Act? The German Federal Office for Information Security (BSI) accompanies the transition period of the Cyber Resilience Act with a technical guideline that specifies requirements for SBOM and reporting. This guideline does not, however, replace the risk assessment that companies must carry out themselves for their products and supply chains. Sources 1. [Umsetzung des Cyber Resilience Act: Deutsche Industrie hat noch Nachholbedarf](https://www.heise.de/news/Umsetzung-des-Cyber-Resilience-Act-Deutsche-Industrie-hat-noch-Nachholbedarf-11425603.html)heise online 2. [Cyber Resilience Act: Zeitplan und Anforderungen](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Cyber_Resilience_Act/cyber_resilience_act_node.html)BSI 3. [Verordnung (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=CELEX:32024R2847)EUR-Lex ## الأسئلة الشائعة ### From when does the Cyber Resilience Act reporting obligation apply? The reporting obligation under Article 14 CRA applies from 11 September 2026. Manufacturers must send an early warning within 24 hours and a follow-up notification within 72 hours via the single reporting platform. The clock starts when the manufacturer becomes aware of the issue. ### When does the Cyber Resilience Act apply in full? The Cyber Resilience Act entered into force on 10 December 2024 and applies in full from 11 December 2027. The reporting obligation for vulnerabilities and incidents applies earlier, from 11 September 2026. ### Which SBOM format does the CRA require? The CRA does not mandate a specific technical format for the software bill of materials. In practice, CycloneDX and SPDX have become established. What matters more is that the SBOM stays current and is coupled to build and release processes. ### Are manufacturers liable for vulnerabilities in supplied components under the CRA? Yes, manufacturers remain liable for supplied components. According to the ONEKEY survey cited by heise online, only 18 percent of suppliers provide the necessary CRA information, so missing information must be requested from the supply chain. ### What should companies prepare first for the Cyber Resilience Act? Companies should create a complete product inventory that shows per product whether a machine-readable SBOM exists and which suppliers still owe information. They should also document an escalation process for actively exploited vulnerabilities, with access to the reporting platform and a named owner for the 24-hour deadline.