EU Cyber Resilience Act reporting is live. Indian exporters, this is your problem now.

The EU Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force in December 2024. Most of it applies from 11 December 2027, which is why many companies filed it under "later". The reporting obligations in Article 14 didn't wait. They have applied since 11 September 2026.

If you manufacture or develop a product with digital elements that is sold in the EU, you are already late if you don't have a working vulnerability intake and reporting process, and blaming your distributor will not help, because the obligation is yours.

I do EU CRA readiness work for companies building connected products, and the same gap shows up every time. Engineering knows how to fix a vulnerability. Nobody knows who is supposed to tell a European authority about it, or how fast.

Who is in scope

The CRA covers products with digital elements made available on the EU market: hardware with software inside it, standalone software, and their remote data processing. Connected devices, industrial controllers, consumer IoT, mobile apps sold as products and a lot of B2B software all fall in.

Being outside the EU changes nothing. If your product reaches EU buyers, as a manufacturer you carry the reporting obligation, and your importers and distributors have their own duties to check you've met yours.

What Article 14 requires

For an actively exploited vulnerability in your product: an early warning within 24 hours of becoming aware of it, a vulnerability notification within 72 hours with more detail, and a final report no later than 14 days after a corrective measure is available.

For a severe incident affecting the security of your product: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.

Reports go to the designated CSIRT and ENISA through a single reporting platform. You are also expected to inform affected users, and where appropriate all users, about the vulnerability or incident and the measures they can take.

The gap I see most

Most product teams can patch quickly. Very few can answer, at 2 AM on a Saturday, whether a vulnerability is being actively exploited, which products and versions it affects, and who has authority to send a report to a European authority.

That depends on things that are not engineering: knowing exactly which components are in which product version, which is what a software bill of materials is for, having a published way for researchers to report issues, and having a named person on call for the decision.

Europe now expects a 24 hour early warning from some companies whose disclosure process is a contact form that emails an intern.

What to do this quarter

List every product you sell into the EU, with versions still in use. Generate an SBOM for each. Publish a coordinated vulnerability disclosure policy and a security contact. Write a one page reporting runbook: who decides, who submits, what the 24 hour warning contains. Test it with a tabletop exercise before you need it.

Then start on the essential requirements that apply from December 2027, including secure by default configuration and security updates for the product's support period. Fines for breaching those can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher.

Treat a regulation like this as a set of dated obligations with owners, the same way you treat ISO controls, so the 2026 reporting duties and the 2027 product requirements sit on one plan instead of two spreadsheets.

If you sell into Europe, your vulnerability process is now part of your product, and Europe has started timing it.