Starting today, manufacturers must be prepared to report certain cybersecurity vulnerabilities and incidents under the EU Cyber Resilience
Act.
The new reporting obligations highlight a broader shift in cybersecurity, where cybersecurity is no longer optional, but it must be managed throughout the product lifecycle.
For customer, that raises important questions about vulnerability handling, supplier communication and incident response readiness.
The Questions Customers are Really Asking
For years, product security discussions focused on security features such as secure boot, hardware roots of trust, cryptographic engines, secure enclaves and tamper resistance.
Those capabilities remain important. However, they are no longer the whole story.
Customers increasingly want to understand how suppliers manage security after products have been deployed. They are starting to ask different questions:
- How do you handle a vulnerability when it appears?
- When and how will potentially impacted customers be informed?
- What information can you provide to help us assess the impact?
- What happens if a vulnerability affects products already deployed in the field?
These questions cannot be answered by silicon alone. They require defined processes, governance, clear responsibilities, coordinated communication and effective vulnerability management.
As organizations prepare for CRA compliance, these operational capabilities are becoming an increasingly important part of supplier evaluations and security assessments. Vulnerability handling, security contacts, incident coordination, software components and support expectations now appear regularly in those discussions.
Clear guidance is essential for meeting industry regulations. Learn more about how NXP helps
manufacturers streamline CRA compliance and achieve long-term resilience.
CRA Reporting Starts Today
Today, 11 September 2026, marks an important milestone in the implementation of the EU Cyber Resilience Act (CRA) and a new phase in cybersecurity accountability across the supply chain.
From this date, the vulnerability and incident reporting obligations of the CRA become applicable. Manufacturers of products with digital elements must now be ready to notify authorities of actively exploited vulnerabilities and severe incidents affecting product security within strict timelines.
At first glance, this may seem like another regulatory milestone. In practice, it introduces new operational requirements for how organizations assess, report and communicate cybersecurity issues.
The obligations applying today make vulnerability reporting an operational requirement. Manufacturers need to adjust how a (potential) vulnerability will be assessed and, if the reporting criteria are met, how it will be notified and communicated, even while the technical investigation is still under way.
In many cases, initial reporting and assessment decisions may need to be made while technical analysis, impact assessment and root-cause investigations are still ongoing.
CRA Reporting at a Glance
- 11 September 2026: Reporting obligations to authorities and customers for actively exploited vulnerabilities and severe security incidents begin to apply
- Within 24 hours: The manufacturer must submit an early warning after becoming aware of a reportable case
- Within 72 hours: The manufacturer must submit a more substantive vulnerability or incident notification
- Final Report: must be submitted for i) an actively exploited vulnerability 14 days after corrective or mitigating measures become available, and ii) for severe incidents within 1 month after initial report
- Customer information: After becoming aware of an actively exploited vulnerability or severe incident affecting product security, manufacturers also need to inform impacted customers and where appropriate to all users, including relevant mitigation or corrective measures where necessary
Manufacturers report through the CRA Single Reporting Platform (SRP). The notification is addressed to the coordinating Computer Security Incident Response Team, or CSIRT, designated as coordinator and, except in particularly exceptional circumstances, made available simultaneously to ENISA.
Beyond these reporting obligations, the broader CRA framework will continue to phase in. The main CRA obligations, including conformity assessment and CE marking requirements, become applicable from 11 December 2027.
Why the 24-Hour Clock Changes the Game
The reporting obligations that take effect today introduce demanding timelines for reportable vulnerabilities and incidents. Once awareness of a reportable case is established, the statutory timeline begins, even while investigations are still ongoing.
The challenge is not simply meeting a reporting deadline. Organizations need the people, processes and information required to make informed decisions quickly and coordinate actions across security, engineering, legal and communications teams.
This reflects a fundamental reality of modern product security: vulnerabilities may be discovered at any point in a product's lifecycle. What matters is the ability to receive a report, assess its validity and significance, understand its impact and communicate effectively with stakeholders.
This is where a Product Security Incident Response Team (PSIRT) plays an important role. The CRA reporting requirements build upon NXP's existing Product Security Incident Response Process (PSIRP).
Rather than creating a separate vulnerability handling process, the CRA extends established PSIRT activities such as vulnerability intake, triage, assessment, mitigation, disclosure and customer communication with additional regulatory reporting obligations.
What Customers can Expect from NXP's PSIRT
NXP's Product Security Incident Response Team (PSIRT) serves as the public entry point for reporting potential vulnerabilities affecting NXP products.
The PSIRT coordinates with the relevant technical, product and security teams to assess reported issues and support the appropriate response.
From a customer perspective, this process includes five key areas:
1. Public Reporting Channel
Potential vulnerabilities involving NXP products can be reported through NXP's public PSIRT reporting channel.
This gives customers, partners and security researchers a defined path for bringing a product security concern to NXP's attention.
2. Assessment and Triage
Reported issues are evaluated through NXP's established vulnerability handling processes.
This assessment may include validating the reported issue, determining the severity and identifying potentially affected products and versions.
Relevant technical and product teams contribute to this analysis as appropriate.
NXP follows responsible disclosure practices, balancing timely communication with the need to validate findings, assess impact and support effective mitigation activities.
3. Response Planning
When an issue is confirmed, NXP evaluates available remediation options.
Depending on the situation related to the issue and product, these may include mitigation guidance, workarounds, software updates or other corrective measures intended to reduce the associated risk.
4. Customer Communication
Depending on the issue and the applicable disclosure conditions, information may be provided through suitable communication channels to help potentially impacted customers understand the potential impact and available actions.
The content depends on factors such as the affected products, the information available at that stage, corrective or mitigating measures, confidentiality considerations and responsible disclosure requirements.
In situations involving actively exploited vulnerabilities, potentially impacted customers may need timely information to understand the potential impact and available mitigation actions.
Depending on the circumstances, available mitigations, responsible disclosure considerations and applicable disclosure requirements, NXP may support this communication through appropriate customer notification channels where appropriate and consistent with responsible disclosure practices.
5. CRA Reporting
When an issue meets the CRA Article 14 reporting criteria, NXP reports through the CRA Single Reporting Platform according to the applicable statutory timeline.
These reporting activities are coordinated through NXP's existing PSIRP framework and, where required, may occur while technical investigations remain ongoing, consistent with CRA reporting requirements.
For customers, the practical benefit is a clear point of contact and a structured and coordinated process for assessing and responding to potential security issues affecting NXP products.
NXP assesses and handles security issues affecting its products. The manufacturer of the finished product remains responsible for evaluating the impact on its own system and meeting the obligations that apply to that product.
Manufacturers benefit from having established security contacts and vulnerability reporting channels with their suppliers.
When a security issue is identified, these communication paths help accelerate assessment, coordination and response.
Three Actions Product Manufacturers can Take Now
1. Confirm Responsibilities and Escalation Paths
Identify who is responsible for vulnerability assessment, technical investigation, legal review, regulatory reporting and customer communication within your organization.
Ensure that reporting processes can operate even while investigations are still developing.
2. Connect your Supplier Vulnerability Channels
Establish documented processes for reporting potential security issues to component and software suppliers.
Maintain up-to-date security contacts for each supplier and define how vulnerability information received from suppliers will be integrated into your internal assessment and escalation workflows.
For potential vulnerabilities involving NXP products, report the issue through NXP's public PSIRT contact channel.
3. Prepare the Information Needed for Rapid Assessment
Maintain accurate product, software and component information so your teams can determine whether a reported vulnerability affects a deployed product.
SBOMs, product identifiers, software versions, deployment records and supplier contacts can accelerate vulnerability assessments and response activities.
From Reporting Readiness to Coordinated Response
The CRA reporting obligations taking effect today reinforce an important point: Organizations need clear ownership, effective coordination and reliable information to respond when security issues arise.
They also need strong collaboration across the supply chain, including component suppliers and product manufacturers, which becomes particularly important when a security issue affects a deployed product.
When a potential vulnerability affects an NXP product, NXP's PSIRT provides a coordination point for vulnerability reporting, technical assessment and customer communication.
The goal is straightforward: help connect vulnerability reporting with the actions needed to manage and respond to potential product security issues.
The September 11 milestone makes vulnerability reporting operational. It also highlights the value of being prepared before the reporting clock starts.
Go Deeper
Learn more about the CRA
Prepare for vulnerability reporting
