CRA Vulnerability Management

The CRA makes vulnerability handling a mandatory, lifecycle-long duty for manufacturers of products with digital elements.

🔍 Key obligations include:

Manufacturers must report actively exploited vulnerabilities in their products as well as severe incidents affecting product security. Reporting follows a staged model: an early warning within 24 hours of becoming aware, a more detailed notification within 72 hours, and a final report within 14 days of a corrective measure becoming available. Reports are submitted via a single reporting platform and reach the designated CSIRT and ENISA. These reporting obligations apply from September 2026 — ahead of the CRA's remaining requirements — making them the most urgent work stream for most manufacturers. Meeting a 24-hour deadline reliably requires prepared capabilities: clear internal escalation paths, defined PSIRT roles, report templates and rehearsed criteria for classifying a vulnerability as actively exploited. We build and test exactly these capabilities with you.

The CRA obliges manufacturers to establish and publish a coordinated vulnerability disclosure (CVD) policy. In practice this means providing a clearly communicated contact point through which security researchers and other third parties can report vulnerabilities, ensuring reports are received securely, triaged and acknowledged, and coordinating remediation and publication timelines with the reporter. A functioning CVD process is more than a compliance checkbox: it channels external security research into your remediation pipeline before vulnerabilities are exploited or disclosed publicly without warning. We design CVD policies and intake workflows, integrate them with your PSIRT and ticketing landscape, and define decision rules for disclosure timing — so external reports strengthen your product security instead of triggering ad-hoc crisis management.

Yes — under the CRA, security updates must be provided free of charge and without undue delay for the duration of the product's support period. The support period must reflect the time the product is reasonably expected to be in use and is generally at least five years, unless the expected product lifetime is shorter. Manufacturers must state the support period transparently, and security updates should be provided separately from functional updates wherever technically feasible, so users are not forced to accept new features to stay secure. For product planning this has real commercial consequences: support commitments, update infrastructure and end-of-life communication need to be priced and planned per product line. We help you define support periods and update strategies that are both compliant and economically sustainable.

The consequences operate on several levels. Violations of the essential requirements, including vulnerability handling obligations, can be fined with up to EUR 15 million or 2.5% of global annual turnover, whichever is higher. Beyond fines, market surveillance authorities can order corrective actions, restrict availability or require products to be withdrawn or recalled from the EU market — for most manufacturers a far greater commercial risk than the penalty itself, since CRA conformity is a condition for CE marking and thus for market access. Added to this are reputational damage and potential liability exposure if unpatched vulnerabilities lead to customer incidents. Early, systematic implementation is therefore not only a compliance duty but protection of your EU revenue base.