On September 11, 2026, at 00:00 CET, ENISA started the clock.

CRA reporting SLA timeline: 24h, 72h, 14d vulnerability deadlines from manufacturer awarenessHorizontal timeline showing the EU Cyber Resilience Act reporting flow: trigger event on Sep 11 2026, then four sequential SLA milestones (24h, 72h, 14d, plus 1 month for severe incidents), and Dec 11 2027 as the full application date.EU Cyber Resilience Act — mandatory notification clockActively exploited vulnerability or severe incident detected → clock startsTRIGGERReasonable awareness(CVE publication /incident report)24 hoursEarly warningENISA + CSIRTvia SRP (SingleReporting Platform)72 hoursFull notificationDetailed assessmentof vulnerabilityor incident14 daysFinal reportPost-fix(severe incident: 1 month)Penalty for non-compliance (reporting + essential cyber requirements):€15M or 2.5% of global annual turnoverwhichever is higher. Lower fines (€10M / €5M) apply to documentation, conformity, authorized representative obligations.Full CRA calendar:11 Sep 2026Reporting SLA11 Dec 2027Full application(CE mark + security by design)
Figure 1. The clock runs from "reasonable awareness" of the manufacturer, not from forensic confirmation. SRP has no API yet — reports are manual. The €15M / 2.5% fine applies to the SLA + to the essential cyber requirements (vulnerability handling, support period, mandatory patching).

As of that moment, every IP camera, NVR, VMS, or analytics module sold on the EU market — whether the manufacturer is Korean, Chinese, European, or Mexican — is legally bound to report to the European Union Agency for Cybersecurity (ENISA) any vulnerability that is actively exploited in the product. The initial warning must arrive within 24 hours. The fine for non-compliance is €15 million or 2.5% of total worldwide annual turnover, whichever is higher [1][2][3][4]. The rest of the CRA — security by design, the CE mark, mandatory support periods — applies from December 11, 2027 [2][4].

The question for your next RFP is no longer “is it NDAA-compliant?”. It is “what is your vulnerability-reporting SLA, in writing?”.

The 24/72/14 clock

Article 14 of the CRA imposes a mandatory notification regime with three deadlines, all counted from the moment the manufacturer has “a reasonable degree of certainty” that a vulnerability is being actively exploited (or that a severe incident has compromised the product’s security) [1][2]:

  • Early warning: ≤ 24 hours — to ENISA + the CSIRT (Computer Security Incident Response Team) of the Member State where the manufacturer has its main establishment [1][4].
  • Full notification: ≤ 72 hours — detailed assessment of the vulnerability or incident [1][2].
  • Final report: ≤ 14 days after a corrective measure is available (vulnerabilities), or ≤ 1 month after the 72-hour notification (severe incidents) [1][2].

All of it flows through the CRA Single Reporting Platform (SRP), operated by ENISA and live since September 11, 2026. There is no API yet — submissions are manual, through forms [3][4][5]. The manufacturer is also required to notify affected users “without undue delay” [1][4].

What’s in scope

The CRA’s scope is horizontal, not sectoral. Crowell & Moring explicitly lists as in-scope examples: network equipment and routers, microprocessors and microcontrollers, operating systems, browsers, industrial software, supply chain management, IoT devices, VPNs, and firewalls [3]. That includes every IP camera, NVR, VMS, and analytics module with the ability — direct or indirect — to connect to a network or another device [3].

Excluded: regulated medical devices, vehicles, civil aviation, marine equipment, defense/national-security products, and — relevant for SaaS — standalone SaaS software is out of scope, though the associated “remote data processing solution” component may be in [3].

The fine and what changes the math

Non-EU manufacturers don’t get a pass. The CRA applies to any manufacturer placing products on the EU market, regardless of where it is headquartered [3][4]. The €15M / 2.5% fine applies specifically to non-compliance with the notification obligations and with the essential cybersecurity requirements (vulnerability handling, support period, mandatory patching) [2][3]. For lesser obligations (technical documentation, authorized representative) the fine is lower, up to €10M or 2% [3]. And the regulator can order the product withdrawn from the EU market on top of the fine [3].

The math that just changed, per Crowell: after December 11, 2027, European buyers (public and private) will expect CRA-compliant products, and the CE mark under the CRA will function as “a visible signal of security trustworthiness” [3]. A non-compliant product will not sell after that date — not only because of regulatory risk, but because the customers will require it [3].

What to ask before you buy

If today you are signing a contract for a CCTV system that will be deployed (or is already deployed) in an operation with EU presence, these are five technical questions the procurement side usually doesn’t ask — and that the CRA has now made implicitly mandatory:

  1. What is your vulnerability-reporting SLA, in writing, in hours? If the vendor takes more than 24 hours to notify ENISA, you are operating equipment from a vendor that just accumulated a fine. The CRA does not bind you directly — but it obliges you to know.
  2. Do you have a documented Coordinated Vulnerability Disclosure (CVD) policy? The manufacturer needs a channel for external researchers to report bugs. No CVD, no “awareness” — but not having a CVD is not a defense against the clock [2][3].
  3. Do you have an up-to-date Software Bill of Materials (SBOM) per product? The SBOM becomes mandatory when the remaining CRA provisions kick in December 2027 [3][4]. If the vendor doesn’t have it today, it won’t have it tomorrow.
  4. What is your internal escalation process from “a CVE is published” to “we are reporting to ENISA”? The clock runs from reasonable awareness, not from forensic confirmation [2][3].
  5. How do you notify B2B customers? The CRA does not require the vendor to notify corporate buyers on its own (unless you are the product’s “user” under CRA terms) — but commercial contracts increasingly do [3]. If your supplier doesn’t bring it in the contract, put it there yourself.

The editorial angle that no trade press is covering

September 11 passed. The SRP is live. There are no public reports of exploited vulnerabilities in IP cameras channeled through the SRP yet — the first reports (or the first enforcement test) are imminent within the next 30 days. The question for the EU CCTV ecosystem is not whether the CRA changes the rules, but how many manufacturers already have the five elements above documented, and how many will improvise when the first CVE lands.

For the buyer in Mexico, LATAM, or EU-bound: the question is not “do I have to comply with the CRA?” — no, the CRA binds the manufacturer, not the buyer. The question is “am I buying equipment from a manufacturer that is already in compliance, or one that will have to exit the EU market in 14 months?”. Those are two different answers for a system with a 5-7 year service life.

P.D. Does your next RFP include a “CRA readiness statement” from the vendor, or are you still only asking about NDAA and resolution?

( What changes the math is that until now camera cybersecurity was a hardening question — how fast they patch, what firmware runs. The CRA turns that into a legally binding commitment with a quantifiable fine. The first CVE filed through the SRP will be news in every European security trade publication. You’re on the right side of that news cycle if you ask the question before it breaks. )

Sources

[1] EU Commission, “Cyber Resilience Act — Reporting obligations”, accessed 2026-09-14, https://digital-strategy.ec.europa.eu/en/policies/cra-reporting — primary, official EU.

[2] Jones Day, “EU Cyber Resilience Act: 24-Hour Reporting Duties Start September 11, 2026”, Jul 2026, accessed 2026-09-14, https://www.jonesday.com/en/insights/2026/07/eu-cyber-resilience-act-24hour-reporting-duties-start-september-11-2026 — legal alert, top-tier global firm.

[3] Crowell & Moring, “EU CRA Countdown: 11 September 2026 Incident/Vulnerability Reporting Deadline Less Than 100 Days Away”, accessed 2026-09-14, https://www.crowell.com/en/insights/client-alerts/eu-cyber-resilience-act-countdown-11-september-2026-incidentvulnerability-reporting-deadline-is-less-than-100-days-away — legal alert, scope + fines + structural analysis.

[4] The Register, “EU’s Cyber Resilience Act starts the 24-hour vulnerability clock”, Sep 11, 2026, accessed 2026-09-14, https://www.theregister.com/security/2026/09/11/eus-cyber-resilience-act-starts-the-24-hour-vulnerability-clock/5295821 — trade press, industry reaction (Netscout, Checkmarx, DLA Piper).

[5] ENISA, “Single Reporting Platform (SRP)”, accessed 2026-09-14, https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp — primary, EU agency.

Editorial metadata

  • Pillar: P5 regulatory + P2 best practices (procurement implications)
  • Cluster: P5 regulatory (PITT, biometria-2026, lfpdppp-video-mexico, flock-coalicion-pr)
  • Coverage angle: ES/LATAM trade press has been silent on the Sep 11 effective date; EN legal-trade press (Jones Day, Crowell) + EN trade press (Register) + EU primary (Commission, ENISA) all confirmed.
  • Word count: ~1,200 words (within P5 target 1000-1400).
  • Next review date: 2026-09-21 — check for first SRP-filed CVE; update hooks accordingly.
  • Disclaimer: This post is editorial analysis, not legal advice. For CRA compliance questions specific to your procurement, consult counsel in your jurisdiction.

Jedi — regulatory beats aren’t my primary beat, but when a hard date lands and the ES trade press is silent on it, that’s my lane. Pairs with p5-pitt-alpr-federal-pipeline (US federal surveillance angle) and p5-biometria-camaras-2026 (EU AI Act biometric angle). The complementary video-trust pillar is ONVIF Profile V Media Signing Add-on (sourcing pending).