Fast Facts
The CRA reporting obligations under Article 14 of the EU Cyber Resilience Act took effect September 11, 2026, and most IIoT vendors had their compliance timeline pointed at the wrong date. Any manufacturer of a digital-element product sold into the EU — PLCs, gateways, sensors, connected machinery already shipped — now has 24 hours to file an early warning after learning of active exploitation, and 72 hours for a full notification. The duty is retroactive, penalties run to €15 million or 2.5% of global turnover, and full CRA product compliance doesn’t arrive until December 2027, which is exactly why most teams assumed they had more runway.
Most compliance calendars at industrial IoT companies have one CRA date circled: December 11, 2027, when full product requirements and CE marking become mandatory. But the CRA reporting obligations arrived first, on September 11, 2026, and already apply to hardware sitting in factories and warehouses today. A manufacturer that learns of an actively exploited vulnerability in a gateway shipped in 2019 is on the same 24-hour clock as one shipping a new sensor next quarter.
The Deadline Everyone Circled Was the Wrong One
The CRA entered into force in December 2024, and most compliance briefs since have treated 2027 as the date that matters. Legal trackers at Jones Day and the National Law Review flag the same pattern: teams treat reporting as a footnote to the bigger conformity deadline, when it’s actually the first bill coming due. The CRA reporting obligations don’t wait for a redesign or a certification cycle — they apply the day a company learns of active exploitation, on equipment shipped years before the rule existed.
📊 The Numbers That Matter
- Sept 11, 2026 — Article 14 reporting obligations took effect
- 24 hours — early-warning deadline once a manufacturer becomes aware of active exploitation
- 72 hours — full-notification deadline
- €15M or 2.5% of turnover — maximum penalty
- Dec 11, 2027 — the later, separate deadline most plans were built around
What Article 14 Actually Requires
The process runs in three stages: an early warning to ENISA and the national CSIRT within 24 hours of becoming aware, a fuller technical notification within 72 hours, and a final report within 14 days of a fix (or one month for a severe incident). None of it needs a new certification body — it needs a working detection-to-disclosure pipeline most hardware manufacturers never had to build before the CRA reporting obligations made it mandatory.
Scope runs wider than most IIoT teams expect: any product with digital elements that connects to a device or network, which sweeps in PLCs, gateways, sensors, and embedded control systems, not just smart-home devices. It also reaches products already on the EU market, so a decade-old gateway in a German plant carries the same duty as next year’s model.
The Supply Chain Has No Named Owner
A connected sensor is usually the work of a silicon vendor, a module maker, an ODM, a platform provider, a connectivity provider, and an integrator — and the CRA reporting obligations attach to whichever holds manufacturer-of-record status. NIS2 runs a parallel clock attaching its own duty to the operator. Most industrial supply contracts never named who’s accountable when a vulnerability surfaces, and deployments have run for a decade without the question coming up.
“Security is no longer a cost to be minimized.”— Jean-Louis Carrara, SVP Global Sales, Kigen, MWC IoT Summit 2026
What This Costs Procurement Teams
The €15 million ceiling gets headlines, but the bigger cost is operational: a documented bill of materials, a live vulnerability-management process, and a team that can move from “we heard about this” to a filed report inside 24 hours. Cloud vendors are already moving — Amazon (NASDAQ: AMZN) has published guidance aligning AWS IoT with the CRA, and Siemens AG (ETR: SIE) spent much of 2026 issuing patches under its own disclosure process, the same muscle Article 14 now demands of everyone else.
For a buyer renewing an IIoT contract this quarter, the useful question isn’t whether a vendor is “CRA compliant” — nobody fully is before December 2027. It’s whether they can name, in writing, who in their supply chain files the report.
💡 CreedTec Analyst’s Note by Daniel Ikechukwu
Strategic Impact: The CRA reporting obligations turn vulnerability disclosure into a live duty years earlier than expected, reaching backward into equipment already deployed. Vendors treating this as a 2027 problem are building incident-response capability under regulatory pressure instead of on their own schedule.
Stop: Assuming December 2027 is the operative CRA deadline for anything — the reporting clock is already running.
Start: Asking every IIoT vendor in your supply chain, in writing, who holds manufacturer-of-record status on your hardware.
Watch: How ENISA’s Single Reporting Platform handles its first filings — early enforcement will show which violations actually draw fines.
ROI Outlook: Compliance spend here doesn’t generate revenue, but it removes a specific tail risk large enough to change a vendor-selection decision on its own. Buyers who build reporting proof into procurement scorecards now face fewer surprise liabilities when December 2027 brings full enforcement.
— Daniel Ikechukwu, CreedTec
Further Reading
- industrial cyberattacks now target factory floors directly.
- a 1980s SIM flaw still threatens industrial IoT.
- ServiceNow-Armis OT/IoT risk findings mean for plant security budgets.
- device lifecycle management is IIoT’s coming bill.
- FCC’s Covered List rewired warehouse robot procurement.
Still planning around December 2027 alone? The CreedTec newsletter tracks every regulatory deadline — CRA reporting obligations included — hiding in the small print. Subscribe so the next one doesn’t catch you mid-renewal.
