The timeline in one paragraph

Regulation (EU) 2024/2847 became law in December 2024. Law-firm timelines agree that the reporting obligations for actively exploited vulnerabilities and severe incidents began in September 2026 and cover products already on the market, while the full set of requirements, including security by design and CE marking under the CRA conformity process, applies from 11 December 2027. The framework for notifying conformity assessment bodies applied from June 2026.

Our earlier article explains the reporting duty itself. This one is about the process underneath it, because you cannot report what you cannot find and you cannot fix what you cannot trace.

Most of the pain in a first reportable incident comes from not knowing which products contain the affected component, not from the reporting form.

A process that works

A workable process has five parts. Intake, so researchers, customers, and automated scanners have a clear route to report issues. Triage, so someone decides quickly whether an issue is exploitable and which products it touches. Remediation, with owners and target times by severity. Disclosure, with a template and an approver ready. And record-keeping, so you can show what you knew and when you acted.

Underneath all of it sits a component inventory. The Act expects manufacturers to identify and document the components in their products, including by drawing up a software bill of materials in a commonly used machine-readable format covering at least top-level dependencies.

Make triage fast

A named on-call owner and a decision tree for exploitability and affected products.

Keep the inventory current

Generate the bill of materials in the build pipeline so it is accurate for every release.

Start small and rehearse

Run a tabletop exercise with a realistic scenario: a critical vulnerability in a widely used library. Time how long it takes to find affected products, decide on a fix, and prepare a notification. The gaps you find will be specific and fixable.

Connect this work to your support and update policies, which also matter for the new product liability rules.

Need to stand up a vulnerability handling process for connected or software products? Talk to us.

Key takeaways

  • CRA reporting duties began in September 2026 and cover products already on the market; full application is 11 December 2027.
  • Build a five-part process: intake, triage, remediation, disclosure, and record-keeping.
  • A current component inventory, including a machine-readable bill of materials, underpins everything else.
  • Rehearse with a tabletop exercise and tie the process to your update and support policies.
This is general information, not legal advice. Timeline details come from law-firm and vendor summaries as of October 2026 that differ in places; confirm against Regulation (EU) 2024/2847 and Commission guidance.