EU CRA reporting deadlines: what should release teams change now?

TL;DR: The EU Cyber Resilience Act makes release governance continuous, requiring product teams to know what is in every version, block known exploited vulnerabilities, and report active exploitation within 24 hours, according to Anchore, with non-compliance carrying fines up to €15 million or 2.5% of global turnover. The practical shift is from periodic scanning to evidence-ready SBOM, VEX, and reporting workflows that keep pace with the regulatory clock.

Editorial analysis by NHI Mgmt Group, based on content published by Anchore: “What EU CRA’s 24-hour deadline means for your SBOM”.

By the numbers:

• Non-compliance under the EU CRA can mean fines up to €15 million or 2.5% of global annual turnover.

Key questions

Q: What breaks when release compliance is still managed as a periodic review under EU CRA?

A: Periodic review breaks because the regulation is tied to what is in the release and whether a vulnerability is actively exploited now, not when the next scan runs.

Q: Why do known exploited vulnerabilities create a faster compliance risk than ordinary CVEs?

A: Known exploited vulnerabilities create faster risk because they immediately change the reporting and market-compliance posture of a shipped release.

Q: What are the signs that SBOM-based compliance is failing in release operations?

A: The main signs are manual evidence reconstruction, inconsistent affected-status decisions across teams, and dependence on scheduled scans to discover whether a release is reportable.

Practitioner guidance

• Define the product as the compliance unit Model each shipped product as a release-scoped asset with versioned component inventory, ownership, and reporting metadata so evidence is tied to the release rather than the scan job.
• Automate SBOM and VEX linkage Keep imported supplier SBOMs, container analyses, and engineering VEX decisions in a single release record so the affected state can be exported without reconstruction.
• Trigger alerts from policy-state changes Configure notifications when a release moves from pass to fail because vulnerability intelligence changed, and route those alerts into product security and incident response queues.

Bottom line: EU CRA turns software release management into a continuous compliance discipline with hard reporting deadlines and market consequences.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →