Cyber Resilience Act is here! Myth busting and first impressions

What it is

Operational detail on the EU CRA's Single Reporting Platform (SRP), live September 11, 2025, beyond the myth-level framing: the exact fields a mandatory report requires, how the two final-report clocks differ, and how submission works before your company account is validated.

The required initial-report fields

The only mandatory fields in the 24-hour initial report are: Type (vuln or incident), Title, Summary, Manufacturer name, Member states where the product is available, Product name, and Version. Product type/classification is optional; you can list multiple products. That is the whole form.

Two different final-report clocks

The summary gives the 14-day-after-fix rule but not the incident branch. There are two:

• Actively exploited vulnerabilities — final report due 14 days after you release the remediation (not 14 days after discovery).
• Severe incidents — final report due one month after the 72-hour notification.

Both are preceded by the 24-hour early warning and the 72-hour notification.

Submitting without pre-registering

ENISA recommends not pre-registering. The operational reason this is safe: an Authorised Representative can submit notifications while account validation is still pending, and the platform accepts up to 20 submissions from unvalidated users — so up to 20 people can register for one company to file in an emergency. Account verification itself took the author three business days (Belgium's CSIRT). The platform supports passkey auth; the author recommends enrolling backup devices to avoid lockout.

Prioritization tie-in (what makes a vuln reportable)

Only vulnerabilities actively exploited with malicious intent, or severe incidents, are reportable — a vuln you found with no exploitation evidence is not. Aikido's stated approach is to monitor CISA's KEV catalog and expose an "Exploit Status" filter surfacing vulnerabilities with known in-the-wild exploits, plus an "actively exploited in the wild" contributing factor in the severity score, as the early indicator that reporting obligations may apply.

Caveats

Voluntary/safe-harbor reporting (disclosing without legal consequence) is a later phase — for now the author says use the platform only for mandatory notifications. The harmonised standards EN 40000-1-1 (terminology) and EN 40000-1-3 (vulnerability handling/disclosure) are still drafts; they define the actual technical build rules ahead of the December 11, 2027 full-compliance deadline.