Cyber Resilience Act 24-Hour Vulnerability Reporting: Providers & Prices (2026)

• CRA Article 14 requires 24-hour reporting of exploited vulnerabilities to ENISA.
• Non-EU manufacturers must appoint an EU-based authorised representative for reporting.
• REP27 — Europe Services, SE charges €490/year for the Article 18 mandate.
• Competitor prices: kadano (€999/year), Euverify (£590/year), others on request.
• Legal advice, SBOM generation, and conformity assessment are not included by REP27.
• Not required for importers, distributors, or legacy products placed before 11 Sep 2026.

Updated 16 October 2026 · 8 sources checked

Providers compared

Prices as published on each provider's website on 16 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: CRA Article 14 & 18

The Cyber Resilience Act (CRA) introduces a strict regime for manufacturers placing products with digital elements on the EU market. Article 1 defines the scope: hardware and software with digital elements, including connected devices, firmware, and apps, are covered. Article 10 sets essential requirements for cybersecurity measures throughout the product lifecycle, while Article 11 details manufacturers' obligations, such as risk assessment, vulnerability handling, and conformity assessment.

Article 14 is central: it requires manufacturers to report any actively exploited vulnerability or severe incident affecting product security to ENISA via the single reporting platform within 24 hours of becoming aware. The duty is triggered by credible evidence of exploitation or a significant security event, not by mere discovery of a vulnerability. The 24-hour clock runs in calendar hours, including nights, weekends, and holidays.

For manufacturers established outside the EU, Article 18 requires the appointment of an authorised representative established in the EU. This representative is responsible for handling the 24-hour reporting process and acts as the official point of contact for EU authorities. Importers and distributors have their own obligations under Article 12, but the primary reporting duty falls on the manufacturer or their authorised representative.

Products placed on the EU market before 11 September 2026 are exempt from the 24-hour reporting requirement but must comply with other CRA provisions. Non-compliance can result in fines up to €15 million or 2.5% of global annual turnover, whichever is higher. The law is clear: if you are a non-EU manufacturer selling digital products in the EU after this date, you must have an authorised representative ready to act within 24 hours of any qualifying incident.

How to Choose a CRA Authorised Representative

Choosing the right authorised representative is critical for compliance and operational efficiency. Start by verifying the provider's legal entity, establishment in the EU, and track record. For example, REP27 — Europe Services, SE is established in Prague, Czech Republic, and has been active since 2018, with mandates signed for companies in 24 countries.

Key selection criteria include:

• Transparent Pricing: Look for clear, published prices and renewal terms. REP27 publishes both first-year and renewal prices. Some providers, like kadano and Euverify, also publish prices, while others require a quote.
• Scope of Mandate: Ensure the mandate is limited to Article 18 duties. Overbroad mandates may claim to cover Article 13 obligations, which Article 18(2) forbids. REP27 explicitly limits its scope to Article 18 reporting.
• Availability: The reporting desk should be staffed 24/7, including weekends and holidays. REP27 guarantees continuous coverage, while details for other providers may require confirmation.
• Certificate Verification: A verifiable certificate (such as REP27's QR code and public verification) provides proof of appointment and can be checked by authorities or customers.
• Exclusions: Clarify what is not included, such as legal advice, SBOM generation, or technical testing. REP27 lists all exclusions clearly; many competitors do not.

Bundled services (e.g., technical scanning, SBOM generation) may be useful if you lack internal resources, but always check for hidden costs, unclear renewal prices, or vague service descriptions. Ask for the process in writing, including how requests are handled, in which languages, and during which hours.

Finally, ensure the provider's mandate is verifiable and that their process for forwarding authority requests is prompt and documented. This is not just a compliance checkbox—delays or miscommunication can have legal and commercial consequences.

What the Price Really Includes: Provider Comparison

Understanding what is included in the published price is essential to avoid surprises. Below is a detailed comparison of what each provider offers, based on available data:

REP27's price (€490/year, €440 on renewal) is for the Article 18 mandate only, with clear exclusions. Kadano and Euverify publish prices but do not specify inclusions or exclusions publicly. Providers like ResilienceWP and Seentrix offer additional technical services (SBOM, scanning, documentation), but pricing and scope are only available on request.

Always request a detailed service description and confirmation of renewal prices before signing. The costliest mistake is assuming technical compliance or legal advice is included when it is not.

Hidden Costs & What Providers Usually Do Not Say

While the headline price is important, hidden costs and exclusions can have a major impact on your compliance budget and operational risk. Here’s what providers often do not disclose upfront:

• Exclusions: REP27 is explicit: no legal advice, DPO services, technical compliance assessments, SBOM generation, or testing are included. Many competitors do not publish such exclusions, so always ask. Technical compliance (SBOM, conformity assessment, engineering) is never included in a representative-only mandate and must be budgeted separately.
• Renewal Prices: Some providers offer a low first-year price but do not publish renewal rates. REP27 publishes both upfront. Always get renewal terms in writing to avoid unexpected increases.
• Per-request Fees: Some representatives may charge extra for each authority or data subject request, or for urgent filings. REP27 does not state any such fees, but this is not always the case elsewhere. Clarify before signing.
• Notice Periods and Termination: The process for ending the mandate or switching providers is rarely detailed. Ask about notice periods and any associated fees.
• Liability Limits: Most representatives limit their liability for missed deadlines or incorrect filings. These limits are not always disclosed on public pages.
• Bundled Services: Providers offering technical services (e.g., SBOM, scanning) may charge significant extra fees or require long-term contracts. Confirm the scope and pricing in writing.

In summary, the true cost of compliance includes not just the representative’s fee but also your internal engineering, technical compliance, and the costs of maintaining a 24/7 incident response process. Always request a full breakdown and written confirmation of all terms before committing.

How Appointment Works: Step by Step

Appointing a CRA authorised representative is a process that requires careful planning and documentation. Here’s a practical step-by-step guide based on current best practices and what is required by law:

1. Assess Applicability: Confirm your product is a digital element (hardware/software) placed on the EU market after 11 September 2026. If so, the CRA 24-hour reporting requirement applies.
2. Select a Provider: Compare providers based on published price, scope, exclusions, and reputation. Request all terms and renewal prices in writing.
3. Contract and Mandate: Sign a written mandate with your chosen authorised representative. REP27 issues a signed Article 18 mandate and verifiable certificate within 24 hours. Ensure the legal entity is established in the EU and listed in the commercial register.
4. Update Documentation: Record the representative’s details in your compliance runbook. Prepare a clear reporting process, including who can declare an incident and how evidence is documented.
5. Internal Preparation: Name at least two staff members as submitters for the ENISA platform, ideally in different time zones. Pre-write early warning templates and assign responsibility for the 72-hour notification and user communication.
6. Incident Response: When a qualifying vulnerability or incident is detected, notify your representative immediately. The representative files the early warning to ENISA/CSIRT within 24 hours, then follows up with the 72-hour notification and final report.
7. Record Keeping: Maintain detailed logs of awareness, submission times, and communications. This is critical if your compliance is ever questioned by authorities.
8. Ongoing Review: Regularly review your processes and update contact details, templates, and responsibilities as needed.

This process ensures you meet the CRA’s strict deadlines and avoid penalties. The key is preparation: define triggers, assign roles, and rehearse the workflow before the law takes effect.

Risks, Fines, and Compliance Deadlines

The Cyber Resilience Act introduces significant legal and financial risks for non-compliance. Article 15 outlines enforcement procedures and penalties. The most immediate risk is missing the 24-hour reporting deadline for actively exploited vulnerabilities or severe incidents. The clock starts when you become aware, not when the investigation is complete. Delays can result in fines up to €15 million or 2.5% of global annual turnover, whichever is higher.

Other risks include:

• Market Access Delays: Failure to appoint a representative or to provide a verifiable certificate can delay product launches or result in procurement stalling, especially in enterprise sales cycles.
• Enforcement Actions: Authorities may initiate investigations, require documentation, or impose corrective measures if reporting duties are not met.
• Reputational Damage: Public reporting failures can harm your brand and customer trust.
• Multiple Reporting Regimes: A single incident may trigger reporting under CRA, NIS2, GDPR, and GPSR, each with different clocks and authorities. For example, a ransomware attack exploiting your product could require three separate reports.

Compliance deadlines are strict: the 24-hour reporting requirement applies from 11 September 2026 for new products. Legacy products placed before this date are exempt from the 24-hour rule but must comply with other CRA provisions. The support period for security updates—at least five years—is another hidden cost that must be planned and budgeted as a product line, not a one-off project.

In summary, the risks of non-compliance are substantial, and the cost of failing to prepare is far higher than the cost of appointing a qualified representative.

Decision Matrix: Do You Need a CRA Authorised Representative?

Use the following matrix to determine if you need a CRA authorised representative:

This matrix covers most scenarios. If in doubt, consult your legal counsel or contact a provider for clarification. Remember, the duty falls on the manufacturer or their appointed representative, not on the importer or distributor unless they place the product under their own name.

Checklist: Steps to CRA 24-Hour Reporting Compliance

1. Map your products: List all products with digital elements sold in the EU and their launch dates.
2. Assess internal processes: Review how vulnerabilities are detected, escalated, and documented within your organisation.
3. Select a representative: Compare providers, request written confirmation of all fees, renewal prices, and scope of service.
4. Sign the mandate: Obtain a signed Article 18 mandate and verifiable certificate from your chosen provider.
5. Update documentation: Add the representative’s details to your runbook and compliance documentation. Prepare early warning and notification templates.
6. Assign reporting roles: Name at least two submitters for the ENISA platform, ideally in different time zones.
7. Test your workflow: Run a tabletop exercise simulating an exploited vulnerability to ensure everyone knows their responsibilities and timelines.
8. Train your team: Educate staff on what triggers the 24-hour clock and how to escalate incidents.
9. Monitor regulatory updates: Stay informed of any changes to CRA requirements or reporting platforms before September 2026.
10. Review and update regularly: Revisit your processes and documentation annually or after any major incident.

Following this checklist will help ensure you are prepared to meet the CRA’s strict reporting obligations and avoid costly penalties.

Realistic Scenarios: Which Route Applies?

• US SaaS company selling to EU businesses: The company is a non-EU manufacturer placing digital products on the EU market. It must appoint an authorised representative for Article 18 reporting (e.g., REP27, kadano, Euverify). The internal security team detects vulnerabilities and notifies the representative, who handles ENISA/CSIRT filings within 24 hours. No importer or distributor is involved, so the duty is direct.
• Chinese Amazon seller shipping IoT devices to EU consumers: If the seller is the manufacturer and established outside the EU, it must appoint an authorised representative. If Amazon acts as the importer of record, the reporting duty may shift to Amazon. The seller should clarify with the platform and, if required, appoint a representative and update product documentation accordingly.
• UK online shop selling own-branded routers in the EU: As a non-EU manufacturer, the UK firm must appoint an authorised representative for 24-hour reporting. The representative’s details must be included in compliance documentation, and internal processes must be ready to escalate incidents rapidly. If the shop also acts as importer or distributor under its own name, additional obligations may apply.

These scenarios demonstrate the importance of mapping your supply chain and clarifying roles. The simplest compliant route is to appoint a representative, document the process, and ensure your team is trained and ready for rapid response.