EU Cyber Resilience Act: the dates, and a free security.txt check.
Regulation (EU) 2024/2847 sets cybersecurity rules for products with digital elements sold in the EU. Its vulnerability and incident reporting duties already apply. Check the dates against the official text, then check that people can find where to report a vulnerability to you.
Not legal advice. Not a guarantee of compliance. This page summarizes Regulation (EU) 2024/2847 as published in the Official Journal, checked on 2026-11-09. Whether your product is in scope (Articles 2 and 3) is a legal question for your counsel.
Key dates
| Date | What applies | Article |
|---|---|---|
| Regulation enters into force | Art. 71(1) | |
| Chapter IV: notification of conformity assessment bodies | Art. 71(2) | |
| Article 14: manufacturers' reporting of actively exploited vulnerabilities and severe incidents | Art. 71(2) | |
| All other obligations | Art. 71(2) |
As of this page's date (2026-11-09), the Article 14 reporting duties apply. Article 14 also covers products placed on the market before December 11, 2027 (Art. 69(3)). Source: Regulation (EU) 2024/2847 on EUR-Lex, Official Journal of November 20, 2024.
Article 14 reporting time limits
| Event | Early warning | Notification | Final report |
|---|---|---|---|
| Actively exploited vulnerability (Art. 14(2)) | within 24 hours of becoming aware | within 72 hours | no later than 14 days after a corrective or mitigating measure is available |
| Severe incident (Art. 14(4)) | within 24 hours | within 72 hours | within one month after the incident notification |
Notifications go at the same time to the CSIRT designated as coordinator and to ENISA, through the single reporting platform (Art. 14(1), Art. 16). Manufacturers must also inform impacted users (Art. 14(8)).
Free security.txt check
security.txt (RFC 9116) is a common way to publish where vulnerability reports should go. The CRA asks manufacturers to provide a contact address for reporting vulnerabilities (Annex I, Part II, point 6) and to name a single point of contact (Annex II, point 2). It does not require security.txt by name.
security.txt result
A security.txt file is one small piece. It doesn't show that your product meets the CRA.
Need the reporting files in one pack?
We generate a CRA reporting starter pack from what you send us: a security.txt file, a vulnerability disclosure policy filled in with your details, an Article 14 reporting checklist with the 24-hour, 72-hour and final-report steps, and a CycloneDX SBOM generated from your lockfiles. Automated, software-generated files for your team to review.
Online checkout is coming.
Questions
Does the CRA apply to my SaaS?
Articles 2 and 3 define scope; remote data processing is covered only in limited cases. Ask counsel; this page doesn't decide scope.
Is security.txt required?
Not by name. It is one common way to publish the contact the CRA asks for.
What do you store?
We count that a check ran. We don't store your domain or the file.
Do you file reports for us?
No. Reports go from the manufacturer to the CSIRT and ENISA. Our pack gives you files and a checklist.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
- RFC 9116: A File Format to Aid in Security Vulnerability Disclosure: https://www.rfc-editor.org/rfc/rfc9116
- European Commission: Cyber Resilience Act: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
- CycloneDX specification overview: https://cyclonedx.org/specification/overview/