Many firms treated the EU Cyber Resilience Act (CRA) as a problem for 2027. That changed on 11 September 2026. From that date, manufacturers must send an early warning to a national CSIRT and ENISA within 24 hours of learning that a flaw in one of their products is being actively exploited. ENISA’s Single Reporting Platform (SRP) opened the same day.
The rules on design, documentation and CE marking do not apply until 11 December 2027, but the reporting duty already covers products on the market today, said Copla.
The CRA regulates products, not companies, and this is where scoping often goes wrong. It covers software or hardware, along with any remote data processing it relies on, sold in the EU and connected to a device or network. Manufacturers carry the heaviest load: risk assessments, secure design, vulnerability handling, technical documentation and conformity assessment.
Importers and distributors must check those duties have been met. For FinTech and SaaS providers, the cloud is the key boundary. A pure SaaS platform generally falls outside the CRA and under NIS2. An app, SDK or device generally falls inside, along with any back end it cannot function without. The Commission’s non-binding guidance of 27 July 2026 includes 67 practical examples that help clarify scope.
Under Article 14, two events trigger reporting: actively exploited vulnerabilities and severe incidents. Both require an early warning within 24 hours and a notification within 72 hours. Final reports are due within 14 days of a fix for vulnerabilities, or within one month for incidents. Submitting to the wrong coordinator CSIRT can invalidate a notification. At launch, the SRP runs in English only and has no API.
Consider a payments firm regulated under DORA that also ships a mobile SDK. A researcher reports an exploited certificate-validation flaw on a Friday evening. If nobody on call owns the decision, the report sits until Monday, and the firm’s awareness timeline becomes contested. The same event may also trigger DORA reporting, with a different clock and a different recipient.
Static checklists fall short because the CRA’s obligations last for each product’s full support period, which must be at least five years. Documentation must be kept for at least ten years. A product launched in December 2027 therefore carries duties until at least 2032. Readiness depends on machinery that keeps running: versioned inventories, an SBOM for every release, a monitored vulnerability intake, and logged decisions.
Firms already running NIS2, DORA or ISO 27001 hold much of this machinery already. The main shift is moving from entity-level controls to product-level controls. Third-party conformity assessment for Class II and critical products, firmware testing and legal opinions on scope still require outside specialists.
Read the full Copla post here.
Copyright © 2026 FinTech Global
