European Commission Publishes Practical Guidance to Help Manufacturers Meet Cyber Resilience Act Reporting Deadline

On July 27, 2026, the European Commission published its first official guidance on applying the Cyber Resilience Act, an 84 page annex to Communication C(2026) 5252. The guidance is non binding and aimed primarily at helping smaller manufacturers apply the regulation without guesswork.

Crafted around 67 practical examples, use cases, flowcharts, and diagrams. It covers four areas:

1. CRA scope for remote data processing and free and open source software.

2. What counts as a substantial modification.

3. How support periods are determined and,

4. How manufacturers should meet their reporting and risk assessment obligations.

The Commission is required to address these four areas at minimum under Article 26 of the CRA, which also directs particular attention to microenterprises and small and medium sized businesses.

The guidance does not change any date in the regulation. The CRA's main obligations still apply from December 11, 2027, and reporting obligations under Article 14 still begin September 11, 2026, the deadline manufacturers should be planning around this year. Under Article 14, a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident must notify its designated CSIRT and ENISA simultaneously. Article 16 of the CRA separately requires ENISA to establish and operate a Single Reporting Platform for these notifications, so a manufacturer reports once through a single electronic channel rather than separately to each member state. That platform was not yet operational as of the guidance's publication. ENISA has said it is on track to be live by September 11, 2026.

The guidance runs 84 pages and works through the CRA's interplay with several other regulations, including the vehicle safety framework and the Machinery Regulation, but medical devices, MDR, and IVDR are not mentioned anywhere in it. For manufacturers of connected accessories, companion apps, or standalone software that supports a medical device without being exclusively regulated under MDR or IVDR, that means the applicability question is still open. What the guidance does offer directly is clarity on the CRA's reporting mechanics. Those mechanics run on their own clock, and through their own reporting channel, separate from any existing MDR vigilance process a manufacturer already has in place. Teams that assume the two can be handled by one workflow should map them separately now, ahead of September.

A few things to doable check:

• First, confirm your incident reporting workflow is ready to meet the CRA's Article 14 notification requirements before September 11, 2026, and register ahead of this date with the CRA's Single Reporting Platform, which Article 16 requires ENISA to build and operate.

• If you manufacture connected accessories, companion software, or products relying on remote data processing that are not exclusively regulated under MDR or IVDR, review them against the guidance's scope examples for a preliminary read on CRA applicability.

• It is important to treat this guidance as reference material to consult when questions arise on substantial modification or support period calculations, not as a compliance checklist with its own deadline.

This is a useful reference document for scope, substantial modification, and support period questions, not a new deadline. September 11, 2026 remains the date that matters for CRA reporting this year, and the reporting channel manufacturers will use to meet it is still being built.

Sources:

• Commission publishes new guidance to support timely Cyber Resilience Act implementation

• Single Reporting Platform (SRP) – ENISA