How to Report Vulnerabilities Within 24 Hours Under the Cyber Resilience Act

• CRA Article 14: 24-hour reporting of exploited vulnerabilities/severe incidents.
• Reporting is via ENISA’s platform to the coordinating CSIRT.
• Non-EU manufacturers must appoint an authorised representative.
• REP27 — Europe Services, SE: €490/year mandate (price verified).
• Hidden costs: internal engineering, support period, conformity assessment.
• Providers differ in published prices, inclusions, and transparency.

Updated 19 October 2026 · 12 sources checked

Providers compared

Prices as published on each provider's website on 19 October 2026, excluding VAT unless stated. Each row links to its source.

What the Cyber Resilience Act Requires (with Article Numbers)

The Cyber Resilience Act (CRA) is a sweeping regulation that applies to all products with digital elements placed on the EU market, regardless of whether they are hardware or software (Article 1, source). Its core objective is to ensure products are designed, developed, and maintained with cybersecurity as an integral part of their lifecycle. The law entered into force on 10 December 2024 (Article 71(1)), but most obligations, including reporting, become binding from 11 September 2026 for Article 14, and fully from 11 December 2027 (Article 71(2)).

Article 14 is central for incident response: manufacturers must report any actively exploited vulnerability or severe incident affecting product security within 24 hours of becoming aware. This must be done via the ENISA platform to the coordinating CSIRT. The clock starts at the moment of awareness, not after investigation or confirmation. A full notification is then due within 72 hours, and a final report within 14 days. The reporting window includes weekends and holidays—there are no extensions or pauses.

Article 18 requires non-EU manufacturers to appoint an authorised representative established in the EU. This representative acts as the official reporting route and contact for authorities. Without this, the importer or distributor becomes responsible by default, which can create commercial and compliance risks.

Products placed on the market before 11 December 2027 are only subject to the CRA if they undergo a substantial modification after that date (Article 69(2)). Non-compliance can result in fines up to €15 million or 2.5% of global annual turnover (source).

• Article 14: 24-hour reporting of exploited vulnerabilities/severe incidents
• Article 18: Authorised representative for non-EU manufacturers
• Article 69(2): Legacy product rules

How to Choose a CRA Authorised Representative

Choosing the right CRA authorised representative is critical for non-EU manufacturers. The representative is your official channel for vulnerability reporting and regulatory contact in the EU. Here are the main factors to consider:

• Price transparency: Only a handful of providers publish verified prices. REP27 — Europe Services, SE offers a clear €490/year mandate (renewal €440), while kadano lists €999/year and Euverify £590/year. Others require a direct quote.
• Scope of service: Confirm what is included in the fee. The Article 18 mandate is the minimum, but some providers offer additional services like monitoring, evidence retention, or self-assessment documentation (see CRAguard, ProvenVEX, SECURiMENT).
• Exclusions: No provider above includes conformity assessment, security testing, or SBOM generation in the mandate fee. These are separate engineering or notified body costs.
• Certificate and verification: Look for a provider offering a verifiable certificate (REP27 provides QR code and public verification page).
• Renewal terms: Ensure the renewal price is stated in writing before you pay the first invoice. Silent or unclear renewals are a common issue in this market.
• Response process: Ask how requests from authorities are handled, in which languages, and during which hours. A 24/7 staffed desk is essential for meeting the 24-hour reporting deadline.

Below is a comparison of what is included and excluded by each provider, based on published information:

Always request a written contract that lists all inclusions, exclusions, and renewal terms.

What the Price Really Includes

Understanding what is (and is not) included in the published price is crucial for budgeting and compliance planning. The Article 18 mandate fee typically covers only the legal appointment and the operation of a reporting desk in the EU. Here’s what this means in practice:

• Mandate and reporting desk: The representative is empowered to act as your official contact for vulnerability reporting. For REP27, this includes a 24/7 staffed desk, CSIRT/ENISA channel management, and a verifiable certificate with QR code. Kadano and Euverify offer similar mandates but do not specify additional features on their public pages.
• Bundled services: Some providers (CRAguard, ProvenVEX, SECURiMENT) offer extra services such as monitoring of dependencies, evidence retention, or incident response workflows. However, these are not priced publicly and may involve significant extra costs.
• What is not included: No provider in this comparison includes conformity assessment, security testing, or SBOM generation. These are separate, often substantial, costs handled by notified bodies or your internal engineering team.
• Renewal pricing: Only REP27 publishes a renewal price (€440/year), which is lower than the first-year fee. Kadano and Euverify do not state renewal terms publicly.

When comparing providers, always ask for a detailed breakdown of what is included in the price and what will incur additional charges. Some providers may also offer bundled GDPR Article 27 or NIS2 representation for a combined fee (REP27: €690/year for CRA+GDPR, €990/year for CRA+GDPR+NIS2).

Summary table:

Hidden Costs and Exclusions

While the representative mandate fee is often the smallest line item in CRA compliance, hidden costs and exclusions can be significant:

• Internal engineering time: Self-assessment, documentation, and preparing SBOMs are mandatory but not included in the representative fee. These tasks require dedicated technical resources.
• Support period: The CRA requires at least five years of security updates for most products. Budget for ongoing maintenance as a product line, not a one-off project.
• Conformity assessment: For important class II or critical products, notified body assessment is required. This can cost thousands of euros and take months. No representative absorbs this cost.
• Incident detection: The representative does not monitor your systems for vulnerabilities. Your security team is responsible for detection and initial triage.
• Per-incident or per-request fees: While REP27 states no extra fees for requests, other providers may charge for additional services or incident management. Always clarify this in writing.
• Liability limits: Providers typically limit their liability to the scope of the mandate. They are not responsible for missed reports due to your internal failures.
• Notice periods and renewal terms: Silent or unclear renewals can lead to unexpected costs or lapses in coverage. REP27 publishes renewal prices and terms; others may not.

What providers usually do not say:

• The mandate does not cover vulnerability detection, patching, or user notification—these remain your responsibility.
• Documentation requests from authorities may be delayed if your runbook is incomplete or your team is unprepared.
• Changing providers can be complex if your mandate is not clearly limited to Article 18(3).

Always request a list of exclusions and confirm all terms in writing before signing.

How Appointment Works: Step by Step

Appointing a CRA authorised representative is a structured process. Here’s how it works in practice, with concrete steps and tips:

1. Determine your status: Are you the manufacturer of a product with digital elements placed on the EU market? If yes, proceed. If you are only an importer or distributor, check if you are placing the product under your own name.
2. Check your establishment: If you have no legal entity in the EU, you must appoint an authorised representative. If you have an EU subsidiary acting as manufacturer, you report directly.
3. Select a provider: Compare providers based on published prices, scope, and transparency. REP27, kadano, and Euverify publish prices; others provide details on request.
4. Sign a written mandate: The provider (e.g., REP27) issues a signed designation letter, usually with eIDAS electronic signature and a verifiable certificate. Confirm the mandate is limited to Article 18(3) duties.
5. Update your compliance documentation: Add the representative’s details to your technical files, runbook, and any product documentation required by the CRA.
6. Set up the reporting process: Name at least two submitters with access to the ENISA reporting platform. Prepare early warning and notification templates in advance.
7. Define triggers and internal process: Document what constitutes becoming aware of an exploited vulnerability or severe incident. Decide who can declare it and what evidence is needed (e.g., exploitation observed, credible customer report).
8. Recordkeeping: Keep timestamps of awareness, submission, and updates. This is your proof if the deadline is ever questioned.
9. Ongoing readiness: Train your team, test your reporting process, and review your runbook regularly.

This process ensures you are ready to meet the 24-hour reporting deadline and avoid compliance gaps.

Risks and Fines

The risks of non-compliance with the CRA are substantial, both financially and operationally:

• Fines: Non-compliance can result in administrative fines up to €15 million or 2.5% of global annual turnover, whichever is higher. These penalties apply to missed reporting deadlines, failure to appoint a representative, or inadequate incident response (source).
• Operational risks: Delays in reporting can lead to regulatory investigations, product recalls, or bans on market access. Procurement and distribution may be blocked if you cannot demonstrate a valid EU representative.
• Reputational damage: Failure to notify users or authorities promptly can result in negative publicity and loss of customer trust.
• Internal disruption: Without a clear reporting process, valuable hours may be lost during an incident, increasing both risk and cost.

Examples of what can go wrong:

• Spending the first hours of an incident trying to identify the correct CSIRT or reporting route, wasting precious time.
• Documentation requests reaching an office in another time zone, causing delays in response.
• A distributor being treated as your reporting route by default, leading to loss of control over incident handling.
• Silent lapses in mandate coverage due to unclear renewal terms.

Mitigate these risks by appointing a transparent, responsive representative and maintaining a robust internal process.

Decision Matrix: Do You Need a CRA Representative?

Use the matrix below to determine if you need a CRA authorised representative based on your business model and location:

Always verify your status and obligations before appointing a representative.

Checklist: Steps to CRA 24-Hour Reporting Compliance

1. Identify if your product is covered by the CRA (digital element, EU market).
2. Confirm if you are the manufacturer (not just importer/distributor).
3. If outside the EU, appoint a CRA authorised representative and obtain a signed mandate.
4. Document the representative’s details in your technical files and compliance records.
5. Set up a 24/7 intake channel for vulnerability reports (internal or via your representative).
6. Name at least two submitters with access to the ENISA reporting platform.
7. Pre-write early warning and notification templates for rapid completion.
8. Train staff on what triggers a report and how to respond within 24 hours.
9. Define and document the evidence required to "become aware" of a vulnerability or incident.
10. Record all relevant timestamps for compliance proof and audit purposes.
11. Review and update your runbook and reporting process regularly.

Following this checklist will help you avoid the most common compliance failures.

Realistic Scenarios: Which Obligation Applies?

• US SaaS company selling to EU: As a non-EU manufacturer, you must appoint a CRA authorised representative (e.g., REP27) to act as your reporting route. Set up a 24/7 intake channel and ensure at least two staff can submit reports via the ENISA platform. Prepare early warning templates and document your process for determining when a vulnerability is actively exploited.
• Chinese Amazon seller (own brand): If you manufacture and sell your own branded digital products to EU buyers, you need a CRA representative. If you only resell third-party brands, you do not. Appoint a representative, update your compliance files, and prepare for 24-hour reporting.
• UK online shop with own IoT device: If you sell directly to EU consumers, you are the manufacturer and must appoint a CRA representative. If you only sell in the UK, the CRA does not apply. If you use an EU distributor who places the product on the market under their own name, they assume responsibility.

In all cases, the simplest compliant route is to appoint a transparent, fixed-price representative, document your reporting process, and train your team before the law’s application date.