On 11 September 2026 the EU Cyber Resilience Act stopped being a future problem. The reporting obligations under Regulation (EU) 2024/2847 took effect that day, and ENISA’s Single Reporting Platform went live alongside them. If your company places products with digital elements on the EU market — and that includes UK manufacturers selling into Europe — the obligation is live now, not in 2027.
Most boards I speak to have filed the CRA under “December 2027”. That is the date the full requirements bite, including CE marking against the essential cybersecurity requirements. But the reporting duties arrived fifteen months early, and they are the ones that can catch a company cold on a Friday afternoon.
The clock, precisely
When a manufacturer becomes aware of an actively exploited vulnerability in one of its products, or a severe incident affecting product security, three deadlines start running:
24 hours for an early warning. 72 hours for a full notification. Then a final report — within 14 days of a corrective measure being available for an exploited vulnerability, or within a month of the 72-hour notification for a severe incident.
Reports go through the Single Reporting Platform to the CSIRT in the country of your main establishment, and are made available simultaneously to ENISA, which shares them with the other national CSIRTs. There is no longer a version of this where a quiet fix ships in the next release and nobody outside the company hears about it.
Why this is a governance problem, not an engineering one
Twenty-four hours is shorter than most companies’ escalation path. It is shorter than a weekend. It is considerably shorter than the time it usually takes to get a technical lead, a commercial director and a lawyer in the same conversation.
And the hard questions are not technical. Who decides that a vulnerability is “actively exploited” rather than theoretically exploitable? Who has authority to file, at 2am, without waiting for the CEO to land? What do you tell your largest customer, and when — before or after the regulator? Who owns the decision if filing triggers a contractual disclosure obligation to a tier-one OEM?
The engineering team can find the bug. Only the board can decide, in advance, who is allowed to pull the trigger. Left undecided, the default answer is that everyone waits for someone else, and the 24 hours goes.
The exposure is not trivial: penalties under the CRA reach €15 million or 2.5% of global turnover.
Where a non-executive director earns their fee
This is exactly the kind of risk a NED exists to surface — material, time-bound, cross-functional, and invisible in the management pack until it detonates. Concretely, a NED should be pressing for five things.
A named accountable person, with an out-of-hours route. Not a team, not a function. A name, a deputy, and a phone that gets answered.
A rehearsal against the real clock. One tabletop exercise, started deliberately at an inconvenient hour, timed end to end. Companies discover more in ninety minutes of rehearsal than in six months of policy writing.
A Software Bill of Materials that is current. You cannot assess whether a disclosed vulnerability affects your product if you do not know what is inside it. Third-party and end-of-life components are where most of this risk actually lives.
A line of sight to December 2027. The reporting duty is the near-term obligation; conformity assessment and CE marking against the essential requirements follow. That is a product development programme, not a compliance form, and it needs to be in the roadmap and the budget now.
A place on the risk register, with an owner and a date. If the CRA is not on it, the board has not really accepted the risk — it has just not looked at it.
The commercial case, not just the compliance one
There is an upside, and it is worth naming at board level so this does not read as pure cost. Procurement teams at large enterprises and public sector buyers are already asking suppliers to evidence CRA readiness. A company that can answer that question quickly, with a current SBOM and a documented vulnerability handling process, wins business from competitors who cannot.
The companies that treat the CRA as paperwork will spend the next fifteen months doing paperwork. The ones that treat it as a forcing function for genuinely better product security will come out of it with a commercial advantage and a board that sleeps better.
The question to ask at your next board meeting
One question is enough to find out where you stand: if we learned at 6pm on a Friday that one of our shipped products was being actively exploited, who files the early warning, and by when?
If the answer takes more than a sentence, there is work to do — and it is board work, not engineering work.