# 24 Hours to Report: Who Needs to Be Part of the Internal Decision

> Der Beitrag erklärt, wer in einem Unternehmen vor dem 11. September 2026 in die Meldeentscheidung nach Artikel 14 des Cyber Resilience Act eingebunden sein muss. Er richtet sich an Hersteller. Herausgeber ist Swiss GRC.

- URL: https://swissgrc.com/en/24-hours-to-report-internal-decision-makers/
- Publisher: SwissGRC®
- Published: 2026-09-01
- Last updated: 2026-09-17

## Key facts

- Ab dem 11. September 2026 müssen Hersteller aktiv ausgenutzte Schwachstellen innerhalb von 24 Stunden nach Kenntnis gleichzeitig an ein zuständiges CSIRT und an die ENISA melden.
- Die 24-Stunden-Frist beginnt mit der Kenntnis der Schwachstelle und nicht mit einer internen Entscheidung über die Meldung.
- Zuständig ist das CSIRT des Mitgliedstaats der Hauptniederlassung des Herstellers, in Deutschland zum Beispiel das BSI.
- Ohne Hauptniederlassung in der EU gilt nach Artikel 14 Absatz 7 die Reihenfolge Bevollmächtigter, Importeur, Händler und zuletzt der Staat mit den meisten Nutzern.
- Auf die Frühwarnung folgt innerhalb von 72 Stunden ein Folgebericht, der Abschlussbericht innerhalb von 14 Tagen nach Verfügbarkeit einer Korrekturmassnahme.
- Kleinst- und Kleinunternehmen bleiben meldepflichtig, müssen bei einer verpassten 24-Stunden-Frist aber kein Bussgeld fürchten.

From 11 September 2026, manufacturers must report actively exploited vulnerabilities to a competent CSIRT and simultaneously to ENISA within 24 hours of becoming aware of them. This deadline starts when awareness is gained, not when an internal decision is made about whether to report. Organisations that only clarify responsibility, contacts and triage criteria once an incident occurs lose valuable hours. The reporting obligation under Article 14 of the Cyber Resilience Act only works if the decision chain is already in place beforehand.

In short

From 11 September 2026, Article 14 of the Cyber Resilience Act requires an early warning within 24 hours of becoming aware of an actively exploited vulnerability, submitted simultaneously to the competent CSIRT and to ENISA. To meet this deadline, CSIRT assignment, named primary and secondary contacts with a backup rule, and internal triage must already be established before an incident occurs.

24hrs

Deadline for the early warning after becoming aware

cyber-resilience-act.de, Article 14 Reporting Obligations of Manufacturers

72hrs

Deadline for the follow-up report with detailed information

mogwailabs, Reporting and Disclosure Obligations under the Cyber Resilience Act

14days

Deadline for the final report after a corrective measure becomes available

itmr-legal, Cyber Resilience Act: Reporting Obligations under the CRA from 11 September 2026

## What exactly must be reported within 24 hours?

The manufacturer submits an early warning about the actively exploited vulnerability, naming at least the affected member states, simultaneously to the competent CSIRT and to ENISA.

The deadline starts when awareness is gained and requires action without undue delay, but in any case within 24 hours at the latest. The relevant provision is [Article 14 of the Cyber Resilience Act](https://cyber-resilience-act.de/cra/kapitel-2/artikel-14/), which provides for reporting via the single reporting platform, so that the CSIRT and ENISA receive access at the same time.

This first report deliberately stays brief: it identifies the vulnerability and the affected states, nothing more. Organisations that only clarify who is authorised to report and what information is permissible at this stage have already missed the deadline.

## Which CSIRT is responsible, and how does ENISA come into play?

The competent CSIRT is the one in the member state of the manufacturer’s main establishment, in Germany for example the BSI; ENISA receives the same report in parallel via the shared platform.

If a manufacturer has no main establishment in the EU, a statutory order of precedence applies: first the member state of the authorised representative, then of the importer, then of the distributor, and finally the state with the most users. This cascade from Article 14(7) cannot be improvised once an incident occurs; it must be worked through and documented in advance.

Similar uncertainty about one’s own classification is already visible in the NIS2 registration gap, where companies only clarify their own scope of application at a late stage. Under the Cyber Resilience Act, the short deadline makes this problem even more pressing.

## Why must the decision chain be established before an incident occurs?

Because the 24-hour deadline runs from the moment awareness is gained and leaves no time for subsequent organisational clarification, CSIRT assignment, contacts and the approval process must be established in advance.

Before 11 September 2026, a competent CSIRT must be determined based on the location of the main establishment, and a [primary and secondary contact](https://www.advisori.de/blog/cra-meldeplattform-enisa-srp-registrierung) must be named, including a backup rule for holidays and weekends. This preparatory work concerns not only the legal department but also the unit that first detects an actively exploited vulnerability, such as a security operations center.

The backlog visible in other CRA obligations, for instance around the software bill of materials, shows that this kind of preparatory work often only begins late across the industry. Organisations that only clarify approval for a report once an incident occurs lose time that the deadline does not allow for.

CSIRT assignment and named contacts should not be tested for the first time when an incident occurs.

## What follows the early warning?

Within 72 hours, the manufacturer provides a follow-up report with affected product versions, the type of vulnerability and available measures; a final report follows later.

The final report is due within 14 days of a corrective measure becoming available for an actively exploited vulnerability, or within one month for a severe security incident. The coordinating CSIRT only requests an intermediate report on demand; it is not a standard obligation.

Article 14(8) additionally obliges the manufacturer to inform affected users about the vulnerability; if the manufacturer fails to do so, the CSIRTs may carry out this notification themselves instead. This user notification also requires its own approval, which must be planned into the decision chain.

## Who is exempt from the reporting obligation?

Micro and small enterprises remain subject to the reporting obligation but face no fine if they miss the 24-hour deadline; good-faith security research without malicious intent does not fall under the reporting obligation at all.

These exemptions do not change the organisational task: even a small enterprise must know which CSIRT to contact and who approves the report internally. The fine is waived, the deadline is not.

An academic paper describes vulnerability governance as the central lever of this hybrid regulation, in which legally binding requirements are implemented through co-regulation and internal corporate self-regulation, coordinated at EU level by ENISA and the CSIRTs.

## What specifically needs to be clarified by 11 September 2026?

Companies falling under the Cyber Resilience Act should establish the CSIRT assignment, the contacts and the internal approval for the 24-hour report in writing before this date.

A first verifiable step: the unit responsible for product security determines the competent CSIRT by 11 September 2026, based on the main establishment or, in the absence of an EU establishment, on the cascade of authorised representative, importer, distributor and user numbers, and records this in writing. In parallel, primary and secondary contacts with a backup rule are named and integrated into the existing reporting organisation for security incidents.

That short reporting deadlines are not an isolated case is also shown by the BACS reporting deadlines in Switzerland. Organisations that document their own decision chain cleanly once are prepared for both regimes.

Related

### Mapping vulnerability reporting workflows

Information Security maps reporting channels and deadlines for vulnerabilities and documents responsibilities and approvals in a traceable way.

[Information Security](https://swissgrc.com/en/information-security-management-isms-software/)

For practice

## Key points

- Determine the competent CSIRT based on the main establishment or the statutory cascade before an incident occurs.
- Name primary and secondary contacts with a backup rule for holidays and weekends.
- Establish in writing who may approve an early warning without a prior case-by-case legal review.
- Plan the follow-up report, the final report and the user notification under Article 14(8) into the same process.
- Micro enterprises remain subject to the reporting obligation; the same preparation pays off even without the risk of a fine.

FAQ

## Frequently asked questions

From when does the 24-hour reporting obligation of the Cyber Resilience Act apply?

From 11 September 2026, Article 14 of the Cyber Resilience Act requires an early warning within 24 hours of becoming aware of an actively exploited vulnerability. The report goes simultaneously to the competent CSIRT and to ENISA via the single reporting platform.

Which CSIRT is responsible if a manufacturer has no establishment in the EU?

Without an EU main establishment, a statutory cascade applies: first the member state of the authorised representative, then of the importer, then of the distributor, and finally the state with the most users. This order under Article 14(7) must be clarified and documented in advance.

What happens if a micro enterprise misses the reporting deadline?

Micro and small enterprises remain subject to the reporting obligation, but face no fine if they miss the 24-hour deadline. This does not remove the organisational task: they too must know which CSIRT to contact and who approves the report internally.

What information must the first report under Article 14 contain?

The early warning deliberately stays brief and names the actively exploited vulnerability along with at least the affected member states. Further details, such as affected product versions, only follow in the follow-up report within 72 hours.

What follows the early warning under the Cyber Resilience Act?

Within 72 hours, the manufacturer provides a follow-up report with product versions, the type of vulnerability and measures taken. The final report follows within 14 days or one month depending on the case, and Article 14(8) additionally requires informing affected users.

Sources

1. [Article 14 Reporting Obligations of Manufacturers](https://cyber-resilience-act.de/cra/kapitel-2/artikel-14/)cyber-resilience-act.de
2. [CRA Reporting Platform: What Must Be in Place by 11 September 2026](https://www.advisori.de/blog/cra-meldeplattform-enisa-srp-registrierung)advisori

## Frequently asked questions

### Ab wann gilt die 24-Stunden-Meldepflicht des Cyber Resilience Act?

Ab dem 11. September 2026 verlangt Artikel 14 des Cyber Resilience Act eine Frühwarnung innerhalb von 24 Stunden nach Kenntnis einer aktiv ausgenutzten Schwachstelle. Die Meldung geht über die einheitliche Meldeplattform gleichzeitig an das zuständige CSIRT und an die ENISA.

### Welches CSIRT ist zuständig, wenn ein Hersteller keine Niederlassung in der EU hat?

Dann gilt eine gesetzliche Reihenfolge: zuerst der Mitgliedstaat des Bevollmächtigten, dann des Importeurs, dann des Händlers und zuletzt der Staat mit den meisten Nutzern. Diese Reihenfolge nach Artikel 14 Absatz 7 muss vorab geklärt und dokumentiert werden.

### Was muss die Frühwarnung nach Artikel 14 enthalten?

Die Frühwarnung bleibt bewusst kurz. Sie benennt die aktiv ausgenutzte Schwachstelle und mindestens die betroffenen Mitgliedstaaten. Weitere Angaben wie betroffene Produktversionen folgen im Folgebericht nach 72 Stunden.

### Was passiert, wenn ein Kleinstunternehmen die Meldefrist verpasst?

Kleinst- und Kleinunternehmen bleiben meldepflichtig, müssen bei einer verpassten 24-Stunden-Frist aber kein Bussgeld fürchten. Die organisatorische Aufgabe bleibt bestehen: Sie müssen wissen, welches CSIRT zuständig ist und wer die Meldung intern freigibt.

### Was folgt auf die Frühwarnung nach dem Cyber Resilience Act?

Innerhalb von 72 Stunden liefert der Hersteller einen Folgebericht mit Produktversionen, Art der Schwachstelle und Massnahmen. Der Abschlussbericht folgt je nach Fall nach 14 Tagen oder einem Monat, und nach Artikel 14 Absatz 8 sind betroffene Nutzer zu informieren.