Àngela Vercher
Marketing Manager Iberia
Àngela Vercher is a marketing manager with experience in the compliance and regulatory sector. At Formalize, she leads marketing for Iberia, helping compliance, risk, and security professionals stay up to date with regulation and find practical solutions to their everyday challenges.
Key takeaways:
Since September 11, 2026, manufacturers of products with digital elements must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting the security of their product.
The duty sits with manufacturers and covers products already on the EU market. Pure SaaS is generally outside the CRA's scope, and so are products covered by their own sector rules, such as medical devices and vehicles.
The CRA adds a reporting obligation; it doesn't replace any. The GDPR's 72-hour breach notification still applies, and NIS2 has its own 24-hour early warning for significant incidents.
In Spain, NIS2 still hasn't been transposed into national law, so Royal Decree-Law 12/2018 remains the framework for incident notification for now.
The teams best placed to meet these deadlines have agreed in advance how an incident gets classified, who makes the call, and where that decision is recorded.
Recent headlines in Spain put it simply: companies now have 24 hours to report a cyberattack. It's a useful headline, and a simplified one. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, has been in force since December 2024, but the first obligation to apply to manufacturers, the duty to report certain vulnerabilities and incidents, only took effect on September 11, 2026. Most of the regulation, including CE marking and the essential cybersecurity requirements, follows on December 11, 2027. What changed in September is narrower than "every company, every attack," and in some ways more demanding, because it lands on top of reporting duties many organizations already have.
What changed on September 11
Article 14 of the CRA requires manufacturers to report two kinds of events: actively exploited vulnerabilities in their products, and severe incidents that affect the security of those products. Manufacturers submit each report through the Single Reporting Platform of the European Union Agency for Cybersecurity (ENISA), and it reaches both ENISA and the national Computer Security Incident Response Team (CSIRT) designated as coordinator at the same time. The platform went live on the same day the obligation started.
The reporting runs in three stages:
Stage | Deadline | What it contains |
|---|---|---|
Early warning | Within 24 hours of becoming aware | A first alert, including where in the EU the product is available |
Notification | Within 72 hours | More detail and an initial assessment |
Final report | 14 days after a fix or mitigation is available (vulnerabilities), or one month after the notification (severe incidents) | A full description, the cause, and the measures taken |
Manufacturers also have to inform affected users, and where appropriate all users, so they can protect themselves. The obligation doesn't reach back in time, though: according to the European Commission's guidance, manufacturers don't have to retroactively report exploitation they already knew about before September 11.
Who it applies to, and who it doesn't
The 24-hour duty belongs to manufacturers of products with digital elements, which covers most hardware and software that connects to a device or a network. It applies to products already on the EU market, not only to new launches.
Three boundaries are easy to miss:
Pure SaaS is generally out of scope. The CRA regulates products, not services. Cloud services used without any installed component may instead fall under the NIS2 Directive, depending on the provider, although installable clients, agents, or remote data processing that a product depends on can bring an offering back into scope.
Some sectors have their own rules. Products already governed by sector-specific EU legislation, such as medical devices and vehicles, are excluded from the CRA.
Small manufacturers still have to report. According to the European Commission, microenterprises and small enterprises can't be fined for missing the 24-hour early-warning deadline, but the obligation itself applies to them in full.
For organizations that buy software rather than build it, the reporting duty sits with their vendors. That doesn't make it irrelevant. A CRA notification from a supplier is exactly the kind of signal that should feed into your own supplier risk and incident processes.
One incident, three clocks
This is where the comparison with data protection law falls short. The General Data Protection Regulation (GDPR) gives organizations 72 hours to notify a personal data breach, and it's tempting to read the CRA as that window shrunk to 24. In practice, both deadlines run side by side, triggered by different events and sent to different authorities. Add NIS2 for organizations within its scope, and a single incident can start three separate clocks.
Picture a mid-sized software company in Spain. An attacker exploits a vulnerability in one of its installed products, uses it to reach the company's own support systems, and copies customer contact details. Within hours, that company may be looking at a CRA early warning for the exploited vulnerability, a GDPR notification for the personal data involved, and, depending on whether it falls under national NIS rules, a notification for a significant incident affecting its services.
CRA | NIS2 | GDPR | |
|---|---|---|---|
What triggers it | An actively exploited vulnerability, or a severe incident affecting product security | A significant incident affecting the services of an in-scope entity | A personal data breach likely to result in a risk to individuals |
Who reports | Manufacturers of products with digital elements | Essential and important entities | Data controllers |
First deadline | 24-hour early warning | 24-hour early warning | 72-hour notification |
Where it goes | ENISA's Single Reporting Platform, to the coordinating CSIRT and ENISA | The national CSIRT or competent authority | The data protection authority, in Spain the Spanish Data Protection Agency (AEPD) |
The deadlines are the visible part. The difficult part comes in the first hour, when someone has to decide which of these regimes applies, based on incomplete information. All three clocks start once the organization becomes aware of the event, but each regime has its own view of what it needs to be aware of. That decision is easy to underestimate, and in many organizations, the criteria for making it aren't written down anywhere.
Spain's extra layer
Spanish organizations face one more complication. Spain missed the October 2024 deadline to transpose NIS2, and the draft law meant to do it, the Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, was approved by the Council of Ministers in January 2025 and still hadn't been adopted by early September 2026. In July 2026, the European Commission referred Spain to the Court of Justice of the EU over the delay.
Until the new law passes, Royal Decree-Law 12/2018 remains the national framework for incident notification. Concrete national details, such as which authority to notify and under which thresholds, will only be settled once the Spanish text is final. That leaves Spanish teams planning against a directive whose content is settled and a national law they can't read yet. The CRA doesn't have that problem: as an EU regulation, it applies directly, in Spain as everywhere else in the EU.
Will the EU simplify this?
Brussels is aware of the overlap. As part of its Digital Omnibus proposals, the European Commission has proposed a single entry point for incident reporting, built on the CRA platform, so that one notification could satisfy several legal obligations at once. At the time of writing, that's still a proposal. And even if it's adopted, it won't decide for anyone which regimes an incident triggers, or remove the need to meet the shortest applicable deadline.
See how your team would handle the first hour
Bring your current incident process, however informal it is today. We'd rather walk through a realistic scenario with you than describe it in the abstract.
What good preparation looks like
Preparing for this is mostly a matter of a few decisions, made calmly, before the first real incident forces them. In our view, five matter most:
One triage checklist for all three regimes. A short set of questions that checks CRA, NIS2, and GDPR triggers in one pass, instead of three separate processes that each start from scratch.
Named decision-makers, with backups. Someone has to own the call to report, per regime, including on weekends and holidays. A 24-hour clock doesn't pause for either.
Groundwork done in advance. Know which products are available in which EU countries, register on ENISA's platform before you need it, and keep authority contact details current.
A record of every decision, including decisions not to report. When a regulator later asks why an incident wasn't notified, the reasoning should already exist, not be reconstructed from memory.
A rehearsal against a realistic scenario. A tabletop exercise built on a case like the one above shows quickly where the process breaks.
How Formalize supports this
No platform can decide for you whether an incident is reportable, and we don't file notifications on your behalf. What Formalize does is keep the groundwork in one place, so the first hour isn't spent looking for it:
Incident records with named owners and deadlines, including the reasoning behind each reporting decision.
The policies and controls behind your incident response, with clear responsibilities, documented and kept current.
Your NIS2 and GDPR work in the same system, instead of separate tools that each need their own update.
Supplier records connected to your risk work, so a vendor's security notification has somewhere to go.
Are you an advisory firm or consultancy building Cyber Resilience Act services for your clients? We're co-building with partners who bring the technical expertise, and the Formalize Partner Program is the place to start.
This article is for information only and doesn't constitute legal advice.