CRA in October 2026: ENISA notifications are now mandatory

The Regulation (EU) 2024/2847, known as the CRA, has ceased to be a future norm to become an operational reality. Following its entry into force in November 2024, the implementation calendar has reached its first critical milestone: the activation of notification obligations. For cybersecurity professionals, this marks the end of the theoretical preparation period and the beginning of direct legal liability regarding vulnerability management.

Unlike previous regulations that focused on specific sectors, the CRA has an unprecedented horizontal scope. It covers everything from home routers to critical industrial systems, requiring security to be integrated from the design phase. This approach aims to solve the problem of products reaching the market with widespread vulnerabilities and no guarantees of long-term support.

Since September 11, 2026, manufacturers of products with digital elements are required to notify both the designated national CSIRT acting as coordinator and ENISA simultaneously. This obligation is triggered by two specific scenarios: the detection of a vulnerability being actively exploited and the occurrence of a severe incident affecting product security.

This notification is not optional and cannot be delegated to third parties without supervision. The regulation establishes that receiving these notifications is an inescapable legal obligation for the manufacturer, regardless of whether the product is hardware, software, or a combination of both. Non-compliance can lead to significant sanctions, as this is one of the first binding rules in the European product cybersecurity framework.

Although notifications are already mandatory, full compliance with the CRA does not arrive until December 11, 2027. Between these two dates, manufacturers must prepare the rest of their lifecycle processes. This includes generating SBOMs (Software Bill of Materials), signing updates, and conducting conformity assessments for high-criticality products.

A relevant intermediate milestone is June 11, 2026, the date from which the regime for conformity assessment bodies becomes applicable. This means that companies manufacturing products in the highest risk class must already be interacting with notified bodies to obtain the cybersecurity CE marking, a prerequisite for marketing in the EU.

For SMEs, the CRA represents a resource challenge. The European Commission's guidance, approved in July 2026, aims to facilitate compliance for these businesses, but the administrative burden remains considerable. Small organizations are advised to prioritize vulnerability management and documentation of their software supply chain, as these are the points of highest immediate non-compliance risk.

Pure SaaS solutions generally fall outside the direct scope of the CRA, unless they are considered remote data processing solutions connected to a physical product. This distinction is crucial for software companies that must determine whether their product is considered a 'product with digital elements' or a standard software service.

It is fundamental not to confuse the CRA with the GDPR or the AI Act. The GDPR protects users' personal data, while the CRA protects the integrity and security of the digital product itself. A company can comply with the GDPR and still violate the CRA if its product has unpatched vulnerabilities or fails to report security incidents.

The AI Act regulates the development and use of artificial intelligence systems, whereas the CRA applies to any digital product, with or without AI. The intersection between both regulations is growing, especially in managing vulnerabilities generated by AI models, but the compliance frameworks are distinct and require separate audits.

The European Commission has published its official guidance on the application of the CRA, a document of about 80 pages that clarifies manufacturers' most frequent doubts. Although not binding, market surveillance authorities use it as a reference for a coherent reading. Manufacturers must read this document alongside the binding text of the Regulation to ensure compliance.

ENISA has also published guides on cybersecurity in the era of frontier AI, offering perspectives on how AI is influencing the definition of exploitable vulnerabilities. These resources are essential for companies seeking to align their cybersecurity strategies with European regulatory expectations.