# Cyber Resilience Act: What Companies Should Prepare Organizationally Now > Swiss GRC explains what manufacturers must prepare internally for the Cyber Resilience Act reporting obligation, which requires an initial notification within 24 hours. The article covers deadlines, the escalation chain and the position of Swiss manufacturers selling in the EU. - URL: https://swissgrc.com/en/what-companies-should-prepare-organizationally-now/ - Publisher: SwissGRC® - Published: 2026-09-10 - Last updated: 2026-09-17 ## Key facts - The reporting obligation under Article 14 of the Cyber Resilience Act has applied since 11 September 2026 and requires an initial notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. - Manufacturers report in three steps: an early warning within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure becomes available. - For severe incidents unrelated to a vulnerability, the deadline for the final report is one month instead of 14 days. - The general manufacturer obligations under Article 13, including technical documentation and conformity assessment, formally apply only from 11 December 2027, 15 months after the reporting obligation. - The Single Reporting Platform built by ENISA offers no programming interface at launch, so every mandatory notification must go through the web portal. - Swiss companies that sell products with digital elements in the EU or the EEA fall under the Cyber Resilience Act regardless of where they are based. The reporting obligation under Article 14 of the Cyber Resilience Act has applied since 11 September 2026 and requires an initial notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. Meeting this deadline requires the necessary internal structure to be in place long before the first incident occurs. What matters is not the status of the external reporting platform, but the internal chain from detection to the decision on who reports. In short The reporting obligation of the Cyber Resilience Act has applied since 11 September 2026 and requires an initial notification within 24 hours of becoming aware of an incident. To meet this deadline, companies must know the competent CSIRT and have an internal escalation chain from detection to reporting decision in place beforehand, regardless of the status of the ENISA reporting platform. 24hrs Deadline for the early warning notification from becoming aware of an incident Cyber Resilience Act, Article 14 72hrs Deadline for the full notification European Commission, CRA Reporting, 31 July 2026 14days Deadline for the final report after a corrective measure becomes available Element, CRA Article 14 Reporting Obligations Guide, 1 July 2026 ## What the reporting obligation requires from 11 September 2026 Manufacturers must report an actively exploited vulnerability or a severe security incident in three steps: an early warning within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure becomes available. Article 14 of the Cyber Resilience Act requires the first notification without undue delay and in any case within 24 hours of becoming aware of it. The final report must describe the vulnerability, name any malicious actors involved where applicable, and set out the remediation and possible mitigating measures. For severe incidents unrelated to a vulnerability, the deadline for the final report is one month instead of 14 days. ## Why the deadline applies earlier than the ability to meet it The general manufacturer obligations under Article 13, including technical documentation and conformity assessment, formally apply only from 11 December 2027, while the reporting obligation under Article 14 already came into force 15 months earlier. This gap means that the process for detecting active exploitation, which is actually part of the Article 13 obligations, must already function even though it is not formally required until later. Companies relying on the later deadline risk a reporting gap that is not caused by the absence of a legal obligation, but by the absence of detection capability. The catch-up work on reporting obligations and the software bill of materials concerns exactly this gap between the reporting obligation and the documentation obligation. ## Was the Single Reporting Platform ready in time? Ten days before the deadline, on 1 September 2026, the Single Reporting Platform built by ENISA still had no published URL on the public internet, even though it was meant to go live together with the reporting obligation on 11 September 2026. According to ENISA, the platform also offers no programming interface at launch, meaning every mandatory notification must go through the web portal. In addition, the list of national CSIRT designated as coordinators remained unsettled for a long time, which collided with the registration process that requires selecting a competent CSIRT from that list. Under Implementing Regulation (EU) 2026/881, issued on 11 December 2025, the decision on whether to withhold reporting content when forwarding it to ENISA lies with the receiving CSIRT. ## Which internal responsibilities must be in place before the first notification Regardless of the status of the external platform, companies must already know the CSIRT competent for their main establishment and have an internal triage process that compiles the content for the early warning, notification and final report on the required schedule. The decision on whether to trigger a notification rarely rests with a single person. It requires a predefined division of roles between the security team, legal department and executive management. This escalation chain for a 24-hour notification must be in place before an incident triggers the deadline, otherwise the available time is used up by internal coordination. - Detection: who technically establishes active exploitation - Decision: who assesses within hours whether a reporting obligation has been triggered - Content: who supplies the information for the 24-hour, 72-hour and 14-day stages - Submission: who operates the web portal of the reporting platform without an automated interface ## What this means for Swiss manufacturers with EU market exposure Swiss companies that sell products with digital elements in the EU or the EEA fall under the Cyber Resilience Act regardless of where they are based, while Switzerland itself has no comparable horizontal cybersecurity law. This means the internal process for meeting the deadline cannot wait for a later Swiss regulation, but must follow the EU requirement as soon as a product enters that market. The further requirements of the Cyber Resilience Act concern not only the reporting deadline but also conformity assessment and CE marking. A first, verifiable step is to determine the competent CSIRT for each affected product based on the EU main establishment, and to run through the internal reporting chain as a test before a real incident triggers the deadline. Related ### Document vulnerability reporting paths in a structured way The Information Security solution records incidents and vulnerabilities together with their deadlines. It keeps track of who decided and reported, and when. [Information Security](https://swissgrc.com/en/information-security-management-isms-software/) For practice ## Key points - The 24-hour deadline runs from the moment of becoming aware, not from confirmation, so the internal escalation chain must already be in place. - The reporting obligation has applied since 11 September 2026, while the related documentation obligations under Article 13 apply only from 11 December 2027. - Shortly before the obligation took effect, the Single Reporting Platform was not yet publicly accessible and offers no interface for automated notifications at launch. - Companies should determine the competent CSIRT based on their EU main establishment now, regardless of the technical status of the reporting platform. - Swiss manufacturers selling into the EU or the EEA are subject to the Cyber Resilience Act regardless of where the company is based. FAQ ## Frequently asked questions From when does the reporting obligation under Article 14 of the Cyber Resilience Act apply? The reporting obligation under Article 14 has applied since 11 September 2026. It requires an initial notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident, independent of the later deadline for the general manufacturer obligations under Article 13. Which deadlines follow after the initial 24-hour notification? After the early warning within 24 hours, the Cyber Resilience Act requires a full notification within 72 hours and a final report no later than 14 days after a corrective measure becomes available. For severe incidents unrelated to a vulnerability, the deadline for the final report is one month instead. Was the ENISA reporting platform ready when the obligation took effect? Ten days before the deadline, the Single Reporting Platform still had no published URL. At launch it also offered no programming interface, meaning notifications must be submitted through the web portal. The list of national CSIRT designated as coordinators also remained unsettled for a long time. Does the Cyber Resilience Act also affect manufacturers based in Switzerland? Yes. Swiss companies that sell products with digital elements in the EU or the EEA fall under the Cyber Resilience Act regardless of where the company is based. Switzerland itself has no comparable horizontal cybersecurity law that could replace the internal process. Who decides whether reporting content is withheld when forwarded to ENISA? Under Implementing Regulation (EU) 2026/881, issued on 11 December 2025, the receiving CSIRT decides whether reporting content is withheld when forwarded to ENISA, for instance for reasons of public security or ongoing investigations. Sources 1. [CRA Reporting](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting)European Commission 2. [EU Cyber Resilience Act Reporting Deadline](https://www.techtimes.com/articles/326249/20260901/eu-cyber-resilience-act-reporting-deadline-filing-portal-launches-same-day-it-becomes-mandatory.htm)Techtimes ## Frequently asked questions ### From when does the reporting obligation under Article 14 of the Cyber Resilience Act apply? The reporting obligation under Article 14 has applied since 11 September 2026. It requires an initial notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. ### Which deadlines follow after the 24-hour early warning under the Cyber Resilience Act? A full notification is due within 72 hours and a final report no later than 14 days after a corrective measure becomes available. For severe incidents unrelated to a vulnerability, the final report is due after one month. ### Was the ENISA Single Reporting Platform ready when the reporting obligation took effect? On 1 September 2026, ten days before the deadline, the platform still had no published URL. At launch it also offers no programming interface, so notifications must be submitted through the web portal. ### Does the Cyber Resilience Act apply to Swiss manufacturers? Yes, if they sell products with digital elements in the EU or the EEA, regardless of where the company is based. Switzerland itself has no comparable horizontal cybersecurity law. ### What internal responsibilities must be defined before the first notification? Companies must define who detects active exploitation, who decides whether a reporting obligation is triggered, who supplies the content for each reporting stage and who operates the web portal. They must also know the CSIRT competent for their main establishment.