EU CRA vulnerability reporting: what software teams need to change

TL;DR: The EU Cyber Resilience Act pushes vulnerability management, SBOM visibility, and coordinated disclosure into the product lifecycle, with reporting obligations starting in September 2026 and broader requirements in December 2027, according to Anchore. The compliance test is no longer point-in-time scanning; continuous monitoring and defensible remediation evidence now matter.

Editorial analysis by NHI Mgmt Group, based on content published by Anchore: “EU CRA Vulnerability Management: Requirements, Deadlines, and Compliance Tips”.

By the numbers:

• Vulnerability and severe-incident reporting obligations begin September 11, 2026.
• Most remaining EU CRA requirements become enforceable in December 2027.
• According to Anchore’s 2024 Software Supply Chain Security Report, 40% of respondents reported using SBOMs for vulnerability management.

Key questions

Q: What breaks when vulnerability management is not continuous?

A: Periodic review leaves organisations unable to prove when a weakness was found, how quickly it was triaged, and whether the response met regulatory timelines.

Q: Why does the EU Cyber Resilience Act make SBOMs operationally important?

A: Because an SBOM turns component sprawl into a machine-readable inventory that supports impact analysis, remediation prioritisation, and downstream disclosure.

Q: What do teams get wrong about coordinated vulnerability disclosure?

A: They often treat coordinated disclosure as a communications process instead of a resilience process.

Practitioner guidance

• Establish CRA reporting runbooks Document the 24-hour, 72-hour, and final-report workflow now, including who validates the vulnerability, who approves disclosure, and what evidence each step must retain.
• Centralise SBOM and vulnerability evidence Keep component inventories, vulnerability findings, remediation notes, and historical artefacts in one governed workflow so product teams can trace exposure quickly.
• Automate vulnerability prioritisation Use exploitability, affected-product context, and fix availability to separate actionable findings from noise before they enter the remediation queue.

Bottom line: The EU CRA turns vulnerability management into a lifecycle obligation that reaches product design, support, disclosure, and evidence retention.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →