CRA Vendor Notifications: What Software Buyers Should Require

By DataTip · Published November 14, 2026

The CRA sets reporting duties for manufacturers, but those duties do not tell you exactly when a software supplier will notify your organization or what its message will include. CRA vendor notifications are a separate supplier-terms question: buyers should assess who will make contact, how quickly, and what information will help their teams respond.

The CRA requires manufacturers to report qualifying actively exploited vulnerabilities and severe incidents, including a 24-hour initial alert and direct notification to affected users. That duty does not establish a universal supplier-to-customer deadline. Buyers should assess supplier terms for a clear contact route, expected timing, and useful information.

The CRA’s reporting requirements took effect on September 11, 2026. The broader product-compliance regime is scheduled to apply from December 11, 2027. The CRA is described as EU cybersecurity legislation for products with digital elements. The same reporting highlights manufacturers’ 24-hour reporting deadlines, but that regulatory clock is not a blanket deadline for every supplier-to-customer notice.

Does the CRA apply to the product or service you are buying?

The CRA covers products with digital elements, including software and hardware products, their remote data-processing solutions, and separately marketed software or hardware components. Examples include operating systems, mobile applications, network equipment, firmware, connected consumer devices, and industrial controllers.

Some product categories are excluded. These include medical devices and in vitro diagnostics, type-approved motor vehicles, certified civil aviation equipment, and marine equipment. The exclusions also cover products developed or modified exclusively for national security or defence, products designed to process classified information, and spare parts made to the same specifications as the parts they replace.

Standalone software-as-a-service is generally outside the CRA. The stated exception applies when a remote data-processing solution is designed and developed by the manufacturer and the product cannot perform its functions without that solution. So do not assume that every SaaS service or cloud supplier is covered.

For a buyer, this is the first boundary to establish: identify the product or component connected to the service and whether the CRA may apply. The law is not a universal incident-notification rule for every software relationship.

Who has the CRA reporting duty?

Manufacturers carry the reporting duty. A manufacturer is the party that develops or makes a product, has it designed or made, and markets it under its own name or trademark. A party that substantially modifies a product already on the market also becomes the manufacturer for CRA purposes.

Importers and distributors do not file the manufacturer’s reports themselves. When they become aware of a vulnerability, they must inform the manufacturer without undue delay. If a product presents a significant cybersecurity risk, they must immediately inform the market-surveillance authorities of the Member States where they made that product available.

Open-source software stewards have a separate, lighter regime. The supplied reporting describes the European Commission’s position as setting the start of their reporting obligations at December 11, 2027.

These distinctions matter when a buyer deals with an importer, distributor, or business that sells a product under its own brand. The commercial supplier and the legal manufacturer may not be the same party. Buyers should establish who will communicate with them; the manufacturer’s legal duty and a supplier’s customer-notification commitment remain distinct.

Which vulnerabilities and incidents trigger reporting?

The CRA reporting triggers described here are actively exploited vulnerabilities and severe incidents affecting product security. They do not mean that every vulnerability, test finding, or security event automatically triggers a report.

An actively exploited vulnerability requires reliable evidence that a malicious actor exploited it without the system owner’s permission. Good-faith security testing and coordinated disclosure without malicious intent do not trigger this reporting duty.

A severe incident is one that negatively affects, or could negatively affect, the availability, authenticity, integrity, or confidentiality of product data or functions. The definition also includes certain incidents involving malicious code. The supplied reporting is truncated during its discussion of severe incidents, so it does not support a fuller list of incident scenarios.

These trigger definitions help buyers understand what the manufacturer’s reporting duty concerns. They do not, by themselves, define every event a supplier must report directly to a customer under its terms.

What do the CRA reporting deadlines mean for buyers?

For a qualifying actively exploited vulnerability or severe incident, the supplied reporting describes a 24-hour initial alert and direct notification to affected users. The reporting requirements began on September 11, 2026; the broader product-compliance regime is scheduled to apply from December 11, 2027.

Those dates and duties describe the CRA’s regulatory framework. They do not establish a universal customer-notification deadline or specify every buyer’s contact, the notice’s contents, or contractual rights. Direct notification to affected users does not answer whether a particular supplier will contact your team promptly or provide information in a form your organization can use.

That gap is the buyer’s decision point. A manufacturer’s report to the relevant authorities and a supplier’s notice to its customer are related, but they are not interchangeable obligations.

What should you check in CRA vendor notifications?

At selection or renewal, assess whether the supplier’s terms and operating arrangements answer three practical questions: who will contact your organization, how quickly, and what information will support your response? The CRA’s reporting duties provide context; they do not prescribe a general vendor-to-customer deadline.
Check whether the supplier explains:

• Who sends the notice and where it goes. Identify the contact route and how the notice can reach the people responsible for assessing it.
• When the supplier expects to notify you. Look for a customer-facing expectation that is distinct from the manufacturer’s regulatory reporting duty. The supplied material does not establish a universal deadline for supplier-to-buyer notices.
• What the notice will tell you. Consider whether it will describe the event and the affected product or service, and provide information about available mitigation or corrective measures where known.
• How follow-up information will be shared. An initial notice may not answer every question. Assess whether the supplier explains how it will provide further information as its understanding develops.
  These are questions to assess in supplier terms, not a claim that the CRA requires a particular contract clause. Contract wording alone does not ensure regulatory compliance. Its practical value is to clarify a communication dependency: if your team needs supplier information to assess an event and respond, the contact route, expected timing, and useful information should not be left implicit.

FAQ: Does the CRA require every software vendor to notify customers within 24 hours?

No blanket vendor-to-customer deadline is established by the supplied reporting. The 24-hour initial alert is part of the manufacturer’s CRA reporting duty. Buyers should assess separately what customer-notification timing their supplier terms provide.

FAQ: Does the CRA apply to standalone SaaS?

Standalone SaaS is generally outside the CRA, subject to the stated exception for a manufacturer-designed and developed remote data-processing solution that is necessary for the product’s functions. Buyers should not assume that every SaaS service is covered.

FAQ: Are importers and distributors responsible for filing CRA reports?

No. Manufacturers carry the reporting duty. Importers and distributors have separate duties to inform manufacturers about vulnerabilities and to notify relevant Member State market-surveillance authorities when a product presents a significant cybersecurity risk.

Key takeaways

• The CRA reporting duties began on September 11, 2026; the broader product-compliance regime is scheduled for December 11, 2027.
• Manufacturers report qualifying events. Importers and distributors have separate duties to notify manufacturers or relevant authorities in specified circumstances.
• Standalone SaaS is generally outside the CRA, subject to the stated remote-data-processing-solution exception.
• Assess supplier terms for who will contact your organization, how quickly, and what information will support your response.

Practical tips

• During selection or renewal, identify the supplier contact route and how notices will reach the people responsible for assessing them.
• Distinguish the manufacturer’s CRA reporting duty from the supplier’s customer-notification commitment.
• Check what information the supplier expects to provide and how it will share updates as its understanding develops.