What happened
From 11 September 2026 manufacturers must notify actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements (Article 14 of the CRA, applicable under Article 71(2)). ENISA opened the Single Reporting Platform the same day. An early warning is due within 24 hours of becoming aware, a notification within 72 hours and a final report 14 days after a corrective measure is available for vulnerabilities or one month after the notification for incidents.
What it means for machine builders
This applies to the machines you have already sold, not only to new ones (Article 69(3)). Every machine builder with connected machines in the field needs, today, a way to learn that a vulnerability in one of its components is being exploited, a named person registered on the platform and a decision path that fits in 24 hours. The platform is in English only and has no API at launch. A representative can file up to 20 notifications before the manufacturer link is verified. Open-source stewards are not covered until 11 December 2027. Exploitation you already knew about before 11 September 2026 does not need a retrospective report.
Where Shield Lifecycle fits
Shield Lifecycle matches each new CVE against the components and the declared attack surface of every machine instance, so the 24-hour clock starts with the facts already in hand. Shield Lifecycle
Official source ENISA and European Commission
See also Official: Commission, CRA reporting obligations page · Official: ENISA SRP FAQ
Published 16 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.