CRA compliance for software vendors and distributors

Two dates, not one. On 11 September 2026 the reporting obligation becomes enforceable: 24 hours for an early warning, 72 hours for the full notification, 14 days for the final report. It covers everything you have already shipped. On 11 December 2027 the design requirements follow: software bill of materials, CE marking, no known exploitable vulnerabilities at the time of placing on the market. Those apply only to products placed on the market after that date.

Failure to meet the reporting obligation carries penalties of up to 15 million euros or 2.5% of worldwide annual turnover. That ceiling is aimed at serious failures, not at a small business that filed two hours late. For a small company the real exposure lies elsewhere: a client demanding proof of compliance before signing, an insurer taking an interest after an incident, a competitor publishing a disclosure policy when you have none.

Not under the CRA. The regulation targets those who place a digital product on the market, not those who use one. Running Tiki, WordPress or Nextcloud for your own business does not make you a manufacturer. Neither your hosting provider nor your integrator is one either: they supply a service.

It still reaches you indirectly, through your suppliers. From September 2026 they have to declare their exploited flaws, which makes their diligence verifiable and therefore contractual. Four questions worth asking them now: how quickly do they inform you, what support period do they state, have they published a reporting channel, and do they supply a software bill of materials. A supplier who cannot answer in 2026 will cost you dearly in 2027.

The 24-hour deadline runs in calendar hours. It does not pause for weekends or for August. A flaw confirmed under exploitation at 8 p.m. on a Friday has to be reported before 8 p.m. on the Saturday.

That is exactly what our monitoring subscription covers. Within 8 hours we get back to you, we establish whether the flaw is genuinely being exploited, a published proof of concept is not enough to start the clock, we work out which software and which deployments are affected, and we help you draft the report. A package is one thing you distribute: a plugin, a theme, an image, an appliance. Different versions of the same package count as one.

Limits we prefer to put in writing: the response is not the fix, which falls under your maintenance contract; and we never file on your behalf, because the obligation sits with the manufacturer and cannot be delegated.

Because the value is not in the page count, it is in the decisions those pages settle. A reporting procedure worth having answers precise questions: what evidence counts as active exploitation, who is allowed to file, what happens when that person is unreachable, which information has to be at hand before the form is opened. Those calls take knowledge of both the regulation and your organisation.

Set it against the alternative: improvising on a Sunday morning with a 24-hour clock running, or finding out afterwards that the wrong thing was filed. The fee covers the document, the technical work around it, contact address, security.txt file, published disclosure page, and a walkthrough with your team. We quote five working days and a fixed price, not an open-ended engagement.

Because we don't write compliance in the abstract; we run the stack your risk actually sits on. Twenty years of CMSs, extensions, Linux servers and monitoring, with a CVE watch already running for our clients. When a flaw lands on a component you use, we know what it does, not just which article of the regulation it triggers. And you get one person who knows your setup and who you reach directly.

We also say no. Embedded firmware, hardware and medical devices are outside our expertise, and we tell you so on the first call rather than billing for work we would do badly. If your need goes beyond our scope, a specialist consultancy is the right answer and we will say so.