ENISA Activates EU Cyber Resilience Act Single Reporting Platform for Exploited Flaws

The European Union Agency for Cybersecurity (ENISA) officially activated the Cyber Resilience Act (CRA) Single Reporting Platform, executing Article 16(1) mandates as reporting obligations take effect for manufacturers placing products with digital elements on the EU single market. Under the new operational framework, vendors are legally required to report actively exploited vulnerabilities and severe security incidents through a unified central hub. Compliance timers begin immediately upon a manufacturer becoming aware of an event, enforcing an early warning within 24 hours, an initial assessment notification within 72 hours, and a final report within 14 days of mitigating measures becoming available. For engineering, DevOps, and product security organizations, this marks a profound transition in global compliance and incident response architectures. The regulation binds any organization distributing hardware or software with digital connectivity in the European market. With the 24-hour initial notice requirement, security operations teams can no longer defer reporting until full root-cause analyses or complete remediation patches are developed. Engineering teams must establish direct, real-time lines of communication between bug bounty intake, vulnerability assessment pipelines, and regulatory compliance units to avoid severe regulatory penalties. This shift fits into the broader global trajectory toward mandatory, time-compressed transparency in software supply chains and critical infrastructure. While past frameworks relied largely on voluntary coordinated vulnerability disclosure or industry Information Sharing and Analysis Centers (ISACs), the CRA introduces statutory enforcement similar to critical infrastructure disclosure rules, with open-source software stewards also scheduled to fall under reporting obligations in late 2027. The integration of mandatory disclosures reinforces modern software bills of materials (SBOM) and continuous vulnerability tracking across modern DevOps toolchains. In practice, security leadership must update incident response playbooks to accommodate the CRA triage schedule. Because the reporting portal currently requires consolidated, per-event manual submissions across product lines with API automation slated for future phases, global enterprises must designate clear internal ownership to prevent duplicate filings or missed disclosure deadlines across disparate subsidiaries. Product security teams should integrate automated triage filters into their vulnerability management tools to distinguish between theoretical security flaws and actively exploited vulnerabilities in the wild, ensuring legal thresholds are recognized and actioned in real time.