From 11 September 2026, manufacturers of products with digital components must actively report exploited vulnerabilities and serious incidents to the National Cyber Security Centre (NCSC). The reporting obligation stems from the Cyber Resilience Act (CRA) and is the first part of the European regulation to become applicable.
A report is required when there is reliable evidence that a vulnerability in a product is being actively exploited by someone with malicious intent. Serious incidents affecting the security of the product are also covered by the reporting obligation. The obligation also applies to older products that are available on the European market on 11 September 2026. A vulnerability that has not yet been demonstrably exploited does not need to be reported.
Manufacturers must submit an early warning within 24 hours and send a more detailed report within 72 hours. This is followed by a final report. In the case of a vulnerability, this must be submitted no later than 14 days after a solution has been made available; in the case of an incident, within one month of the report. The deadlines start as soon as the manufacturer becomes aware of the vulnerability or incident.
Reports can be submitted via MijnNCSC or using the reporting form on the NCSC website. The CRA does not require registration, meaning that reports can be submitted without an account. According to the NCSC, the other obligations under the regulation, including product requirements and CE marking, will enter into force on 11 December 2027.
