CRA Assistent
Questions about the Cyber Resilience Act
Questions about the Cyber Resilience Act
Hello, I am the CRA assistant. Ask me anything about the Cyber Resilience Act, about roles and obligations, or about using CRA-Portal.
Stay up to date with the latest developments around the Cyber Resilience Act.
On 21 October 2026 the PHP team disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They allow remote code execution and affect every version from PHP 5.4 onwards. In the Netherlands, DigiD, MijnOverheid, the House of Representatives, the national cyber security centre itself, Schiphol airport and six hospitals went offline as a precaution. For manufacturers it comes down to two questions. Is this component in my product, and in which version? And do I have to report it? An actively exploited vulnerability must be reported within 24 hours, also when it sits in a component you ship rather than in your own code; a known but not yet exploited vulnerability does not start that clock. Anyone running PHP 7.4 had no choice between patching and waiting: that version has been out of support since November 2022 and receives no patch.
During the night of 11 to 12 October 2026, attackers forced the refrigeration systems of an estimated 250 to 350 French supermarkets into a permanent defrost cycle, driving temperatures towards 50 degrees Celsius. Chains affected include Intermarché, Netto, Coopérative U, Leclerc, Carrefour Market and Monoprix. A single store in Alsace reported more than EUR 220,000 in losses; nationally the damage runs into the millions. The control panels made by Danish manufacturer Danfoss are reachable over the internet so maintenance firms can adjust them remotely, and the affected units were running outdated firmware. CISA had already warned in May 2025 about an authentication bypass in the AK-SM 8xxA series (CVE-2025-41450). A refrigeration controller looks like an insignificant box, but it is a product with digital elements: the CRA sets requirements for secure default settings, for authentication on remote access, for a support period with security updates, and for reporting actively exploited vulnerabilities. This incident shows what it costs when that foundation is missing: not a data breach, but days of revenue, spoiled stock and downtime.
What the CRA requires of products · Reporting obligation on exploitation
The ENISA Single Reporting Platform went live on 11 September 2026 at portal.cra-srp.enisa.europa.eu. It comes with a manual for authorised representatives, a tutorial video and a glossary for the form fields. There is no API: registration and reporting are done by hand. Note the two different final-report deadlines: for a vulnerability, no later than fourteen days after a corrective or mitigating measure becomes available; for a severe incident, within one month of the 72-hour notification. Open-source stewards are not in scope until 11 December 2027, and voluntary reporting is not yet available on the platform.
The CRA's incident and vulnerability reporting obligations apply from 11 September 2026 through the ENISA Single Reporting Platform. ENISA has published FAQs, a two-page factsheet and step-by-step guidance on registering and submitting notifications. ENISA also released its Secure by Design and Default Playbook — 22 practical playbooks covering the full product life cycle — and international partners published the 2026 Minimum Elements for a Software Bill of Materials (SBOM).
The European Commission has published its official guidance on Cyber Resilience Act implementation. It clarifies product scope — including remote data processing solutions and free and open source software — what counts as a 'substantial modification', how support periods apply, and reporting and risk-assessment obligations. It includes 67 practical examples, use cases and flowcharts aimed at SMEs and microenterprises.
ENISA has updated its FAQ on the CRA Single Reporting Platform, including the data fields manufacturers must provide when reporting incidents under Article 14. In addition, a public consultation on a draft technical advisory on secure update mechanisms for SMEs is open until 10 July 2026.
OpenSSF submitted community feedback on two EU consultations: the revision of the Cybersecurity Act and amendments to the NIS2 Directive. Input was also provided on ENISA's 'Secure by Design' playbook for SMEs.
ENISA published a draft playbook to help SMEs embed security from the design stage. It provides practical steps for engineering, product and release processes.
The CRA entered into force on December 10, 2024. Manufacturers, importers and distributors of products with digital elements must comply with the new requirements before December 11, 2027.
CRA legislation is still evolving. Contact us for the latest insights.
Our specialists are happy to assist you with your compliance journey.