FOSSA: EU CRA Vulnerability/Incident Reporting Obligations Take Effect

What it is

FOSSA's operational breakdown of the EU Cyber Resilience Act's Article 14 reporting obligation, live since 11 September 2026. The distinct value beyond the catalog summary is the scope and enforcement detail: which already-shipped products are captured, and how the penalty regime interacts with the early-effective date.

Preconditions / Affected

The obligation is broader than a "new products" rule:

• It applies to every in-scope product already on the EU market, including products placed on the market years before the CRA existed.
• It persists even after a product's support period ends.
• It applies regardless of manufacturer location — a U.S. company selling software into the EU is in scope.

This is the opposite of the December 2027 requirements (SBOM, coordinated disclosure), which generally apply only to products placed on the market from that date onward, catching older products only if substantially modified.

What to do

Report to European authorities when you discover either an actively exploited vulnerability (Article 3-42) or a severe incident (Article 15(5)). Note the two triggers are independent — assess each separately. The severe-incident trigger can fire with no underlying vulnerability; FOSSA's examples:

• a compromised build pipeline
• a stolen code-signing key
• a hijacked update server pushing malicious code

Any of these can qualify even if no flaw is identified — so incident detection, not just vulnerability scanning, must feed the reporting workflow.

Caveats

The enforcement picture is deliberately ambiguous, and the page is explicit about it:

• Penalties reach up to €15 million or 2.5% of worldwide annual turnover, but Article 64 (penalties) is NOT among the provisions effective early.
• The reporting obligation is nonetheless legally binding now, and reports you file or fail to file "will form the record regulators look at later."
• FOSSA states it is not aware of any definitive EU guidance exempting pre-December-2027 reporting violations from later fines — i.e., don't assume the missing penalty article means non-compliance is free.

Two further limits the page names on the vulnerability side: there is no single authoritative source of truth for exploitation evidence (CISA KEV and EUVD are suggested filters, not mandated ones), and no standardised process for verifying exploitability in a production context — reachability validation is FOSSA's recommendation, not a regulatory procedure.

flowchart TD
    E[Security event on in-scope product] --> V{Actively exploited<br/>vuln? Art. 3-42}
    E --> I{Severe incident?<br/>Art. 15/5}
    V -->|yes| R[Report to EU authorities]
    I -->|yes, even with<br/>no known flaw| R
    V -->|no| N[No report on this trigger]
    I -->|no| N
    R --> L[Filing becomes the<br/>regulatory record]