Providers for 24-Hour Vulnerability Reporting: Market Overview & Prices (2026)

• The 24h reporting obligation applies from 11.09.2026 for manufacturers of digital products (CRA Art. 14)
• REP27, kadano, and Euverify offer corresponding representation
• Prices: REP27 from EUR 490/year, kadano EUR 999/year, Euverify GBP 590/year
• Services vary: mandate, reporting channel, no technical assessment or SBOM creation
• Not required for importers, distributors, or pure marketplace sellers

Updated 26 October 2026 · 4 sources checked

Providers compared

Prices as published on each provider's website on 26 October 2026, excluding VAT unless stated. Each row links to its source.

What Does the Law Require? (CRA Art. 14, Art. 18)

The EU Cyber Resilience Act (CRA) requires manufacturers of products with digital elements to report actively exploited vulnerabilities or serious security incidents within 24 hours of becoming aware, starting 11 September 2026 (Article 14). Reporting is done via the central ENISA portal and addressed to the responsible CSIRT of the member state. Deadlines are strict: 24 hours for early warning, 72 hours for the first complete report, and 14 days for the final report. The clock runs in real time – including nights, weekends, and holidays.

Manufacturers outside the EU must appoint an authorized representative in the EU according to Article 18 CRA. This representative acts as the reporting channel and contact point for authorities. Without such a representative, compliant reporting is not possible. Importers, distributors, and marketplace sellers (e.g., on Amazon, Etsy, eBay) who do not place products on the market under their own name are exempt. Open-source projects with a non-commercial focus have a reduced reporting regime, but reporting obligations remain.

• Article 14 CRA: 24h early warning, 72h full report, 14 days final report
• Article 18 CRA: Authorized representative for manufacturers without an EU establishment

The exact definition of a reportable vulnerability is crucial: only actively exploited vulnerabilities or serious incidents affecting product security trigger the obligation. Undiscovered or non-exploited vulnerabilities are not reportable. The manufacturer is responsible for meeting deadlines – delays or incorrect reports can lead to severe penalties.

Service Comparison: What's Included, What's Not?

Providers differ significantly in transparency and scope of offered services. REP27 is the only provider publishing all prices and clearly listing what is included and excluded in the mandate. The mandate covers legal representation under Article 18 CRA, a 24-hour desk in Europe, acceptance and forwarding of reports to authorities, and public verification of the mandate. REP27 explicitly does not perform technical assessments, SBOM creation, conformity assessments, or testing – these tasks remain with the manufacturer or must be commissioned separately.

For kadano and Euverify, prices are published but details on included services, possible additional fees, or exclusions are "On request." It is therefore advisable to request written clarification before contracting about exactly which services are covered and whether additional fees apply (e.g., per report, per language, for extraordinary requests).

Important: The actual technical analysis, SBOM (Software Bill of Materials) creation, and security testing are generally not included in the representation price. Those needing these services must commission them separately from specialized providers.

Decision Matrix: Who Needs What?

Whether you need a CRA representative and 24h reporting depends on your role in the supply chain, your location, and your sales structure. The following matrix helps with quick classification:

Practical examples: A US software provider selling SaaS solutions to EU customers needs a representative and must set up 24h reporting. A Chinese IoT manufacturer selling products under its own brand in the EU is also obliged. A UK online shop acting only as a reseller without own brand does not need a representative or 24h reporting.

Buyer Checklist: How to Proceed

1. Check your role: Are you a manufacturer of a product with digital elements marketed in the EU?
2. Determine your location: Is your company located outside the EU?
3. Compare providers: Choose a provider with published prices and clearly defined mandate. Check if the price covers all services or if additional fees may apply.
4. Get written confirmation of services and exclusions: Obtain written confirmation before contracting about what is included and excluded in the mandate.
5. Prepare internal processes: Define who in your company is responsible for 24h reporting. Create a runbook with clear responsibilities and reporting templates.
6. Register representative data: Enter the representative and their contact details in your compliance documentation and inform your team.
7. Test the reporting process: Conduct a simulation of the 24h report before the deadline to identify weaknesses in the process.
8. Regularly review: Annually check if changes in your sales structure or product range affect the reporting obligation.

This checklist helps you avoid typical mistakes and ensures compliance by the deadline.

What Providers Often Don’t Say (Exclusions, Deadlines, Fees)

Many providers do not openly communicate which services are actually included in the mandate and which are not. REP27 explicitly lists that technical assessments, conformity assessment, SBOM creation, and testing are excluded. Additional services like template creation, support with technical analysis, or communication with end customers are also excluded.

• REP27’s price is flat with no hidden fees. The renewal price is fixed in advance and does not change without notice.
• For kadano and Euverify, no information on additional fees, cancellation deadlines, or liability limits is provided. It is recommended to explicitly inquire about these points.
• The manufacturer remains fully responsible for meeting reporting deadlines and report quality. A representative only receives and forwards reports but does not perform technical evaluation.
• REP27 states a 24-hour deadline for mandate issuance. Other providers list processing times as "On request."

A common misconception: The mandate does not cover full CRA compliance. Costly and complex parts (e.g., conformity assessment, technical documentation, SBOM) must be organized separately. Lack of preparation risks delays and fines.

Three Practical Scenarios: Who Must Do What?

• US SaaS Provider: A US-based company offers cloud software to European businesses. As a manufacturer of digital products marketing in the EU, it must appoint a CRA representative. The 24h reporting runs through this representative named in the mandate. The provider must assign internal reporting responsibilities and prepare templates.
• Chinese Amazon Seller: A Chinese company sells IoT devices under its own brand directly to EU end customers. The obligation applies: without an EU presence, a representative under Article 18 CRA is required. Reporting is done via this representative. If the company is only a reseller not using its own brand, the obligation does not apply.
• UK Online Shop: A UK shop sells third-party products to Europe as a reseller but not under its own brand. No 24h reporting or CRA representative is required since the shop is not a manufacturer. Responsibility lies with the actual manufacturer.

These scenarios illustrate how crucial correct role classification is. Errors lead to unnecessary costs or compliance gaps.