Under the CRA, manufacturers placing on the EU market products with digital elements are required to notify two specific types of events:

• Actively Exploited Vulnerabilities: vulnerabilities in products with digital elements for which there is reliable evidence that they have been exploited by a malicious actor;
• Severe Incidents: incidents having a severe impact on the security of a product with digital elements (e.g., compromising its availability, authenticity, integrity, or confidentiality). The criteria for severity are set out in Art. 14(5).

Open-source software stewards will also be subject to reporting obligations, starting from 11 December 2027, to the extent that they are involved in the development of products with digital elements, in accordance with Art. 24(3) of CRA.