Do I need to report actively exploited vulnerabilities or severe incidents for products placed on the market before the entry into force of the CRA?

Please refer to the European Commission’s “FAQs on the CRA Implementation”, in particular subsection 5.3 on the reporting obligations under Art. 14, which will apply from 11 September 2026 to all products with digital elements falling within the scope of the CRA, including products that were placed on the market before 11 December 2027.