CONNECT WITH US
Fintech

Fintech

CRA reporting clock is already ticking for EU manufacturers

Fintech Global logo

Published on

Add as a preferred source on Google
CRA reporting clock is already ticking for EU manufacturers

Many firms treated the EU Cyber Resilience Act (CRA) as a problem for 2027. That changed on 11 September 2026. From that date, manufacturers must send an early warning to a national CSIRT and ENISA within 24 hours of learning that a flaw in one of their products is being actively exploited. ENISA’s Single Reporting Platform (SRP) opened the same day.

The rules on design, documentation and CE marking do not apply until 11 December 2027, but the reporting duty already covers products on the market today, said Copla.

The CRA regulates products, not companies, and this is where scoping often goes wrong. It covers software or hardware, along with any remote data processing it relies on, sold in the EU and connected to a device or network. Manufacturers carry the heaviest load: risk assessments, secure design, vulnerability handling, technical documentation and conformity assessment.

Importers and distributors must check those duties have been met. For FinTech and SaaS providers, the cloud is the key boundary. A pure SaaS platform generally falls outside the CRA and under NIS2. An app, SDK or device generally falls inside, along with any back end it cannot function without. The Commission’s non-binding guidance of 27 July 2026 includes 67 practical examples that help clarify scope.

Under Article 14, two events trigger reporting: actively exploited vulnerabilities and severe incidents. Both require an early warning within 24 hours and a notification within 72 hours. Final reports are due within 14 days of a fix for vulnerabilities, or within one month for incidents.


Source link
Related Topics:Fintech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.