The CRA reporting clock starts September 11 — product security needs an evidence pipeline, not an incident spreadsheet

The Cyber Resilience Act’s reporting obligations for manufacturers begin on 11 September 2026, with early reporting deadlines that can arrive within 24 and 72 hours.

That turns regulatory reporting into an operational product-security workflow. Organizations need structured incident records that preserve awareness time, affected products, evidence, owners, mitigation and reporting milestones.

AppKit can anchor application and environment inventory, Governance can hold policy and evidence, Asset can model affected products, Task can coordinate remediation, and Agent Connect can bring signals into the workflow without making the model the source of authority.

From 11 September 2026, manufacturers must report qualifying actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. Early warning is due within 24 hours and fuller notification within 72 hours of awareness, with different subsequent reporting clocks. Core product requirements follow a separate later timetable.

Simulate a newly discovered exploited vulnerability affecting multiple product versions. Start the awareness clock, record evidence and ownership, then generate consistent reports as details evolve.

Conceptual illustration; a real implementation must be tested separately.

Measure time-to-detect, awareness timestamp provenance, affected-version coverage, timely submissions and final corrective-action trace.

Official reference: Primary publication. Avoid applying these conclusions outside the relevant legal, protocol or product version.